Stefan Prodan 5037beda6c Cap HTTP request and websocket message sizes ...

Unauthenticated clients could exhaust process memory (and, for /store,
disk) by posting arbitrarily large bodies, and could OOM or pin
goroutines via the /ws/echo websocket.

- Wrap request bodies in http.MaxBytesReader (10 MiB) on the echo,
  store, cache and token handlers via a shared readLimitedBody helper
- Bound /ws/echo: per-message read limit, idle read deadline with
  ping/pong keepalive, and write deadlines
- Add regression tests for both limits

2026-06-08 23:58:43 +03:00

..

grpc

Migrate JWT to registered claims

2026-05-20 11:11:58 +03:00

http

Cap HTTP request and websocket message sizes

2026-06-08 23:58:43 +03:00