From 7e4dfc3085e7e4f1a468537b6c38f84ada8ee19f Mon Sep 17 00:00:00 2001 From: riccardone Date: Thu, 22 Oct 2026 11:05:32 +0100 Subject: [PATCH] A body refused for its size says the largest the endpoint takes, and a service that forwards a command takes none it cannot forward Entry 40 of #37. A body too large is 413, with nothing in the refusal a client can act on, and a service that forwards commands may accept one the next hop refuses. best-peer's 413 carries details.limit_bytes, and a workspace's door takes 4 KiB less than the root so a forwarded command always fits. Co-Authored-By: Claude Opus 5.5 --- specs/security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/specs/security.md b/specs/security.md index 3a484fa..548dbc9 100644 --- a/specs/security.md +++ b/specs/security.md @@ -148,7 +148,7 @@ For implementations that serve multiple tenants: ## Input Limits -Servers **MUST** enforce maximum request body sizes for `POST /commands` and **SHOULD** return `413 Payload Too Large` when exceeded. Servers **MUST** bound JSON nesting depth, collection sizes, string lengths, and total attribute counts to prevent parser or validator resource exhaustion. +Servers **MUST** enforce maximum request body sizes for `POST /commands` and **SHOULD** return `413 Payload Too Large` when exceeded, with `details.limit_bytes`, the largest body the endpoint accepts, since a body refused before it is read has no field to name. A service that forwards a command to another service **MUST** accept no body it cannot forward whole. Servers **MUST** bound JSON nesting depth, collection sizes, string lengths, and total attribute counts to prevent parser or validator resource exhaustion. Servers **SHOULD** apply rate limits and quotas per authenticated client and per tenant for command submission.