Skip to content

max_response_body_size for http client#2418

Merged
stephenberry merged 4 commits intomainfrom
http-client-max-size
Mar 31, 2026
Merged

max_response_body_size for http client#2418
stephenberry merged 4 commits intomainfrom
http-client-max-size

Conversation

@stephenberry
Copy link
Copy Markdown
Owner

@stephenberry stephenberry commented Mar 31, 2026

Add configurable body size limits for HTTP server and client

Closes #2417

Adds max_request_body_size (server) and max_response_body_size (client) to guard against memory exhaustion from oversized or malicious payloads. Both default to glz::http_default_max_body_size (100 MB).

Server

  • New connection_config::max_request_body_size field with setter and getter on http_server.
  • Requests whose Content-Length exceeds the limit are rejected with HTTP 413 before the body is allocated or read.
  • Only applies to Content-Length-based requests (the server does not support chunked request Transfer-Encoding).

Client

  • New http_client_error::response_too_large error code with a dedicated std::error_category.
  • New http_client::max_response_body_size() setter and getter.
  • Enforced in all four non-streaming response paths:
    • Sync Content-Length — checked before reading.
    • Sync chunked — checked before each chunk read.
    • Async Content-Length — checked before reading.
    • Async chunked — checked before each chunk read.
  • Sockets are closed on rejection in all paths to prevent stale data in the connection pool.

Files changed

File Change
include/glaze/net/http.hpp http_default_max_body_size constant (100 MB)
include/glaze/net/http_server.hpp max_request_body_size config, setter/getter, and 413 enforcement in finish_request()
include/glaze/net/http_client.hpp http_client_error enum/category, max_response_body_size setter/getter, enforcement in sync and async paths
docs/networking/body-size-limits.md Documentation page
mkdocs.yml Wire new doc page into nav

@stephenberry stephenberry merged commit 1e8d5a7 into main Mar 31, 2026
48 of 49 checks passed
@stephenberry stephenberry deleted the http-client-max-size branch March 31, 2026 22:07
@stephenberry stephenberry mentioned this pull request Mar 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Max body size

2 participants