Skip to content

A body refused for its size says the largest the endpoint takes, and a service that forwards a command takes none it cannot forward #113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
riccardone wants to merge 1 commit into from
Closed

A body refused for its size says the largest the endpoint takes, and a service that forwards a command takes none it cannot forward #113

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion specs/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,7 @@ For implementations that serve multiple tenants:

## Input Limits

Servers **MUST** enforce maximum request body sizes for `POST /commands` and **SHOULD** return `413 Payload Too Large` when exceeded. Servers **MUST** bound JSON nesting depth, collection sizes, string lengths, and total attribute counts to prevent parser or validator resource exhaustion.
Servers **MUST** enforce maximum request body sizes for `POST /commands` and **SHOULD** return `413 Payload Too Large` when exceeded, with `details.limit_bytes`, the largest body the endpoint accepts, since a body refused before it is read has no field to name. A service that forwards a command to another service **MUST** accept no body it cannot forward whole. Servers **MUST** bound JSON nesting depth, collection sizes, string lengths, and total attribute counts to prevent parser or validator resource exhaustion.

Servers **SHOULD** apply rate limits and quotas per authenticated client and per tenant for command submission.

Expand Down
Loading