Commit Graph
4 Commits
Author SHA1 Message Date
Stefan Prodan 5037beda6c Cap HTTP request and websocket message sizes
Unauthenticated clients could exhaust process memory (and, for /store,
disk) by posting arbitrarily large bodies, and could OOM or pin
goroutines via the /ws/echo websocket.

- Wrap request bodies in http.MaxBytesReader (10 MiB) on the echo,
  store, cache and token handlers via a shared readLimitedBody helper
- Bound /ws/echo: per-message read limit, idle read deadline with
  ping/pong keepalive, and write deadlines
- Add regression tests for both limits
2026-06-08 23:58:43 +03:00
Rodrigo Fior Kuntzer eba7fe186e fix: panic when the WebSocket endpoint is under load 2024-05-23 10:01:01 +02:00
Michael KebeandMichael Kebe 16191504d1 Removed reference to localhost from swagger
Now it is possible to use the swagger webinterface
running on a host other than localhost e.g. in docker
or kubernetes.

Removed the @host line from pkg/api/server.go and
ran make swagger.

Fixes probably #179
2024-04-09 08:54:38 +02:00
JayKaku c305843105 restructured api to api/http, api/grpc, pkg http 2024-02-24 23:44:12 +05:30