Commit Graph
3 Commits
Author SHA1 Message Date
Stefan Prodan 5037beda6c Cap HTTP request and websocket message sizes
Unauthenticated clients could exhaust process memory (and, for /store,
disk) by posting arbitrarily large bodies, and could OOM or pin
goroutines via the /ws/echo websocket.

- Wrap request bodies in http.MaxBytesReader (10 MiB) on the echo,
  store, cache and token handlers via a shared readLimitedBody helper
- Bound /ws/echo: per-message read limit, idle read deadline with
  ping/pong keepalive, and write deadlines
- Add regression tests for both limits
2026-06-08 23:58:43 +03:00
Stefan Prodan 7d8e7005b1 Refactor response header settings
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
2026-05-20 10:50:31 +03:00
JayKaku c305843105 restructured api to api/http, api/grpc, pkg http 2024-02-24 23:44:12 +05:30