Unauthenticated clients could exhaust process memory (and, for /store,
disk) by posting arbitrarily large bodies, and could OOM or pin
goroutines via the /ws/echo websocket.
- Wrap request bodies in http.MaxBytesReader (10 MiB) on the echo,
store, cache and token handlers via a shared readLimitedBody helper
- Bound /ws/echo: per-message read limit, idle read deadline with
ping/pong keepalive, and write deadlines
- Add regression tests for both limits
Now it is possible to use the swagger webinterface
running on a host other than localhost e.g. in docker
or kubernetes.
Removed the @host line from pkg/api/server.go and
ran make swagger.
Fixes probably #179