Disable costly WAF

cdk/app.ts

@@ -13,5 +13,5 @@ new Stack(app, `mfng-ai-demo`, {
   },
   bucketName: `mfng-ai-demo-assets`,
   customDomain: {domainName: `strict.software`, subdomainName: `ai-demo.mfng`},
-  webAclName: `mfng-ai-demo`,
+  // webAclName: `mfng-ai-demo`,
 });

src/handler/index.tsx

@@ -21,10 +21,12 @@ import {
   reactSsrManifest,
 } from './manifests.js';
 import {ratelimitMiddleware} from './ratelimit-middleware.js';
+import {requestBodyMiddleware} from './request-body-middleware.js';
 
 export const app = new Hono();
 
 app.use(authMiddleware);
+app.use(requestBodyMiddleware);
 app.use(ratelimitMiddleware);
 app.use(loggerMiddleware);
 app.get(`/*`, async (context) => handleGet(context.req.raw));

src/handler/request-body-middleware.ts

@@ -0,0 +1,27 @@
+import type {LambdaFunctionURLEvent} from 'aws-lambda';
+import type {MiddlewareHandler} from 'hono';
+
+export const requestBodyMiddleware: MiddlewareHandler<{
+  Bindings: {
+    // Not available in dev server.
+    event?: LambdaFunctionURLEvent;
+  };
+}> = async (context, next) => {
+  const {req, env} = context;
+  const {event} = env;
+
+  if (req.method === `POST` && event?.body) {
+    const bodyByteLength = Buffer.byteLength(
+      event.body,
+      event.isBase64Encoded ? `base64` : `utf-8`,
+    );
+
+    if (bodyByteLength > 10240) {
+      console.warn(`Request body too large`);
+
+      return context.text(`Content Too Large`, 413);
+    }
+  }
+
+  return next();
+};