Description
Description
The idea of this feature lies on the following OWASP recommendation:
Define an appropriate request size limit and reject requests exceeding the limit with HTTP response status 413 Request Entity Too Large
After discussion with @dunglas about implementing this feature in the api-platform project, the subject of implementing it directly in Symfony has been brought.
In my opinion, this feature makes sense in, but is not limited to, a Rest API context, so it'd make sense to implement it in the Symfony HttpKernel component. However, one could argue that this is a security related feature that should live in the Security component.
The implementation would rely on a kernel.request event listener configured with a request content max size (defaulting to ini_get('post_max_size')). Comparison would then be performed against the Content-Length request header. Here's a gist showing how it could look like.
The fact is that it must be implemented smartly in order not to conflict with the existing handling of request size exceeding in the Symfony Form component.
This feature could be disabled by default, for example.
It could be enablable on a global scope, on a route scope, on a pattern scope, ... The choices are quite wide.
Unlike how it's made in the Symfony Form component, I believe it makes sense to perform this check no matter which HTTP method is used.
Finally, unless duplicating this logic in the component which would welcome this feature, we should think about how to extract it in a common package (maybe a new php-directive package which would perform ini_get calls and value normalizations).
Thank you for your time and sharing thoughts about this,
Regards.
Example
Enabling globaly
framework:
prevent_content_length_exceeding: true
max_content_length: 10MEnabling on a route
routes:
index:
path: /
prevent_content_length_exceeding: true
max_content_length: 10M