Limit max request size

As discussed in the Gitter, my opinion is that starlette should provide a default limit for request size. The main reason is that without it, any Starlette application is vulnerable to very easy DoS. For example, newbie me can write a program as follows:

from starlette.requests import Request
from starlette.responses import Response


async def app(scope, receive, send):
    assert scope['type'] == 'http'
    request = Request(scope, receive)
    body = b''
    json = await request.json()
    response = Response(body, media_type='text/plain')
    await response(scope, receive, send)

As a malicious user, I could send a 30GB sized JSON and cause the memory to go OOM. Other frameworks support this also - Django, Quart. My proposal is to add a default limit which can be overrided in the app configuration.

[florimondmanca]

As far as I intuitively agree with the relevance of supporting this in Starlette core, my two cents here…

My proposal is to add a default limit which can be overrided in the app configuration.

Would this be a kwarg on the Starlette class? I don’t think there’s precedent for this - everything else is provided as middleware (even security features such as CORS or trusted hosts). Also not sure this would be the most reusable API (whereas other frameworks would benefit from a public ASGI middleware).

So personally not sure we want a new config option, or just a middleware that’s documented as « you should really turn this on for production » (both in the middleware docs and any « deployment » docs).

[gnat]

For those following this, even behind nginx, I’ve realised there’s a number of ways to run denial of service on Starlette which can be mitigated with a simple timeout middleware. I recommend a dual solution of setting up nginx client_max_body_size, and using a Starlette middleware.

1. For nginx, you need to set client_max_body_size to limit total body size (and in turn, file uploads). For example, to limit to 100 MB, your core http config block should look like:

http {
    client_max_body_size 100m;
    # ... other stuff ...
}

1. As for Starlette itself, a timeout middleware can serve as a “catch all” solution for large file uploads and long running queries. Sample middleware here: https://github.com/tiangolo/fastapi/issues/1752#issuecomment-682579845

from starlette.middleware.base import BaseHTTPMiddleware
from starlette.responses import HTMLResponse
import asyncio

class TimeoutMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request, call_next):
        try:
            response = await asyncio.wait_for(call_next(request), timeout=30)
        except asyncio.TimeoutError:
            return HTMLResponse("Request reached timeout.", status_code=504)
        return response

Timeout middleware seems to free the memory used by the attempted file upload as well.

Any additional thoughts, suggestions appreciated! We all want to achieve the goal of making our Starlette Apps more robust.