Limits and timeouts #5

Open
opened 2026-09-21 22:40:59 +02:00 by sneak · 0 comments
Owner

There need to be sane and defensive request size and time limits, and response size and time limits on both the client direction as well as the backend direction. The all of these values must be able to be overridden with environment variables, but the defaults should be same. I believe the same defaults for request should be 60 seconds and perhaps 100 megabytes. And the same defaults for response should be 30 minutes and uh five gigabytes, these are client facing, and then uh similar ones for the backend facing.

There need to be sane and defensive request size and time limits, and response size and time limits on both the client direction as well as the backend direction. The all of these values must be able to be overridden with environment variables, but the defaults should be same. I believe the same defaults for request should be 60 seconds and perhaps 100 megabytes. And the same defaults for response should be 30 minutes and uh five gigabytes, these are client facing, and then uh similar ones for the backend facing.
Sign in to join this conversation.
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#5