Add withResponseBuffer()
method to limit maximum response buffer size
#175
+182
−3
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This changeset adds a new
withResponseBuffer()
method to limit the maximum response buffer size for all request methods. The default limit is now 16 MiB and can be changed with this new method.This is useful to prevent possible DOS attacks where the client could otherwise run out of memory when receiving a very large response body. Accordingly, this it not considered a BC break even though this might potentially affect existing consumers of this package. The 16 MiB default was chosen as a compromise to not affect most common use cases and still provide a reasonable protection against large responses.
If you're currently processing large responses, you may use the new
withResponseBuffer()
method to increase this limit. As an alternative, you're recommended to use streaming responses which are not affected by this limit and allow processing arbitrary responses.Builds on top of #172 and #170
Resolves #89