Put an upper limit on the amount of batch actions #100

New Issue

oysteikt · 2025-11-10T14:51:32+01:00

oysteikt commented

2025-11-10 14:51:32 +01:00

Something like 1000~2000 by default should be plenty to avoid fraudulent use (who would create 1000~2000 users/dbs in a single go?).

The limit should probably be configurable.

If the upper cap is reached, return an appropriate error explaining the limit breach.

It might also be an idea to calculate an upper byte limit for requests based on this number, to avoid someone DOS-ing the request parser in the server.

Might also be an idea to have a configurable threshold to log suspiciously large numbers of batch actions (should probably be forked into another issue)

Something like 1000\~2000 by default should be plenty to avoid fraudulent use (who would create 1000\~2000 users/dbs in a single go?). The limit should probably be configurable. If the upper cap is reached, return an appropriate error explaining the limit breach. It might also be an idea to calculate an upper byte limit for requests based on this number, to avoid someone DOS-ing the request parser in the server. Might also be an idea to have a configurable threshold to log suspiciously large numbers of batch actions (should probably be forked into another issue)

oysteikt added the security label 2025-11-10 14:51:32 +01:00

oysteikt added this to the Initial release milestone 2025-12-16 10:51:49 +01:00

oysteikt commented

2025-12-16 10:52:03 +01:00

There is now a protocol-wide max limit of 100KB to the server and 1MB from the server. Upon reaching said limit, the server will just terminate the connection and log the error.

oysteikt closed this issue

2025-12-16 10:52:03 +01:00

Sign in to join this conversation.

No Assignees

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Projects/muscl#100