caddy/modules/caddyhttp/requestbody
Kévin Dunglas 6cdffe9502
requestbody: enforce max_size early using Content-Length (#8337)
* requestbody: reject oversized Content-Length before the next handler

When max_size is set and the request declares a Content-Length above it, respond 413 right away instead of letting the next handler start and fail mid-read. Bodies of unknown length are still limited by MaxBytesReader. Both paths return the same error, so handle_errors sees no difference.

* caddytest: send unknown-length bodies in max_size placeholder tests

request_body now answers 413 for a declared Content-Length over max_size before the placeholder reads the body, so these tests no longer covered the read path and the direct respond one failed.

* requestbody: keep the body limited for error routes

Error routes get the same request, so wrap the body before the early 413 to stop them from reading past max_size.
2026-11-03 18:18:40 +10:00
..
caddyfile.go caddyhttp: mitigate slowloris via idle read/write deadlines (#7913) 2026-08-21 21:17:26 -06:00
requestbody.go requestbody: enforce max_size early using Content-Length (#8337) 2026-11-03 18:18:40 +10:00
requestbody_test.go requestbody: enforce max_size early using Content-Length (#8337) 2026-11-03 18:18:40 +10:00