Enforce request body size limit before CSRF middleware parses the form #90

New Issue

clawbot · 2026-08-07T19:12:08+02:00

clawbot commented

2026-08-07 19:12:08 +02:00

Tracking issue from the PR #83 review (non-blocking there — pre-existing idiom shared with the login handler).

Problem

Handlers install http.MaxBytesReader (1 MB) inside the handler, but gorilla/csrf (v1.7.3, helpers.go:113) has already parsed the request body via r.PostFormValue by the time the handler runs. The form is therefore parsed under net/http's default 10 MB cap, and the intended 1 MB limit is never effective for form fields. Affects at least the login and password-change handlers.

Definition of done

The body size limit is applied as middleware BEFORE the CSRF middleware in the chain (route-group scoped), so form parsing happens under the intended cap.
Handler-local MaxBytesReader calls that are now redundant are removed or kept consistent deliberately (documented either way).
Test: an oversized POST body is rejected (413) and the handler is never reached.

Tracking issue from the PR #83 review (non-blocking there — pre-existing idiom shared with the login handler). ## Problem Handlers install `http.MaxBytesReader` (1 MB) inside the handler, but gorilla/csrf (v1.7.3, helpers.go:113) has already parsed the request body via `r.PostFormValue` by the time the handler runs. The form is therefore parsed under net/http's default 10 MB cap, and the intended 1 MB limit is never effective for form fields. Affects at least the login and password-change handlers. ## Definition of done - The body size limit is applied as middleware BEFORE the CSRF middleware in the chain (route-group scoped), so form parsing happens under the intended cap. - Handler-local `MaxBytesReader` calls that are now redundant are removed or kept consistent deliberately (documented either way). - Test: an oversized POST body is rejected (413) and the handler is never reached.

clawbot referenced this issue

2026-08-07 19:12:16 +02:00

Add admin password change flow (closes #65) #83

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/webhooker#90