What's the most reliable way to limit HTTP body size?

Question

I'd like to limit the allowed length of the bodies of incoming HTTP POST requests in my Spring-based Java server application. Most of these requests contain payloads with content type application/json. However, some of them have other content types, e.g. some controllers receive application/octet-stream from a messaging service.

So far, I had been working with a javax.servlet.Filter, that inspects the content length and rejects any overlong requests:

@Component
@WebFilter(urlPatterns = "my-path/*")
public class Limiter implements Filter {

    private static final int MAX_CONTENT_LENGTH_IN_BYTES = 5000;

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
            throws IOException, ServletException {
        int length = servletRequest.getContentLength();
        if (length > MAX_CONTENT_LENGTH_IN_BYTES) {
            // reject request with HTTP 400 Bad Request
        } else {
            // let the request pass
        }

}

While this works fine for JSON-based contents, it fails for some of the others, esp. the octet-streams. For these cases, getContentLength() consistently returns -1. From the Java documentation, I gather that this indicates that the length is unavailable from the input stream.

What's a more reliable way to inspect the content length? Clone the stream, then retrieve it as a string and check the string's length?

Given the first answers, and the redirection to Increase HTTP Post maxPostSize in Spring Boot, let me add this: Don't the multipart settings only affect multipart HTTP requests, i.e. the ones that are split into several chunks for better data transfer? What if my request is big but arrives in a single part?

You dont have to "clone" the stream, just make it rewindable and you can always inspect the buffer length. getContentLength will be rather only when client will send it as header - and this might not be accurate anyway. — Antoniossss, Apr 25 '22 at 07:29

score 0 · Answer 1 · answered Apr 25 '22 at 07:33

0

This may be done directly in the configuration file of your Spring application, e.g in application.yml .

The following would limit sizes to 1Gb.

spring:
  http:
    multipart:
      max-file-size: 1000MB
      max-request-size: 1000MB

answered Apr 25 '22 at 07:33

Arnaud

16,865
3
28
41

Doesn't this affect multipart requests only? What if my request is single part? – Florian Apr 25 '22 at 07:34

score 0 · Answer 2 · answered Apr 25 '22 at 07:33

0

You can use Tomcat's settings to do that

spring.servlet.multipart.max-file-size=1MB
spring.servlet.multipart.max-request-size=1MB

That is obivously for embedded Tomcat if you are using SpringBoot. Otherwise you will have to do such configuration on connector settings which can be found in Tomcat documentation

answered Apr 25 '22 at 07:33

Antoniossss

28,922
5
49
91

Doesn't this affect multipart requests only? What if my request is single part? – Florian Apr 25 '22 at 07:34
Probably not. https://stackoverflow.com/a/33726892/1527544 – Antoniossss Apr 25 '22 at 07:36

What's the most reliable way to limit HTTP body size?

2 Answers2