Enforces restrictions on JSON request bodies to protect against JSON-based attacks and resource exhaustion. Validates against configurable limits to prevent attacks such as:
- Deeply nested JSON structures (billion laughs attack)
- Memory exhaustion from oversized payloads
- Prototype pollution via __proto__ keys in JavaScript backends
- Duplicate key attacks ({"foo": 1, "foo": 2})
JSON documents carried inside a multipart body are inspected part by part, so a JSON document uploaded as an attachment is checked like a plain JSON body.
Example Configuration
- jsonProtection:
maxDepth: 20
maxKeyLength: 50
maxObjectSize: 100
maxTokens: 1000
maxStringLength: 1000
maxArraySize: 100
maxSize: 10000
blockProto: true
reportError: true
otherContentTypes: SKIP
- jsonProtection:
maxDepth: 20
maxKeyLength: 50
maxObjectSize: 100
maxTokens: 1000
maxStringLength: 1000
maxArraySize: 100
maxSize: 10000
blockProto: true
reportError: true
otherContentTypes: SKIP
Syntax
jsonProtection:
blockProto: <boolean>
maxArraySize: <int>
maxDepth: <int>
maxKeyLength: <int>
maxObjectSize: <int>
maxSize: <int>
maxStringLength: <int>
maxTokens: <int>
otherContentTypes: reject
reportError: <boolean>jsonProtection: blockProto: <boolean> maxArraySize: <int> maxDepth: <int> maxKeyLength: <int> maxObjectSize: <int> maxSize: <int> maxStringLength: <int> maxTokens: <int> otherContentTypes: reject reportError: <boolean>
Attributes
| Name | Required | Default | Description | Examples |
|---|---|---|---|---|
| blockProto | false | true | Blocks JSON properties with a key of "__proto__" to avoid prototype pollution in Javascript backends. | - |
| maxArraySize | false | 1000 | Maximum size of JSON arrays. For example, [[1,2],[3,4,5]] has a array size of 2. The nested arrays have sizes of 2 and 3. | - |
| maxDepth | false | 50 | Maximum depth of nested JSON structures. For example, {"a":{"b":{"c":"d"}}} has a depth of 3. | - |
| maxKeyLength | false | 256 | Maximum key length. For example, {"abcd": "efgh123", "ijkl": [ "mnop123" ], "qrst": { "uvwx": 1}} has a maximum key length of 4. (In this example, all 4 strings used as keys effectively have length 4.)The maximum key length also affects strings ("abcd", "ijkl", "qrst" and "uvwx" in the example). The strings can be also limited by the separate property maxStringLength. The stricter limit applies. | - |
| maxObjectSize | false | 1000 | Maximum size of JSON objects. For example, {"a": {"b":"c", "d": "e"}, "f": "g"} has a maximum object size of 2. (In this example, both objects effectively have a size of 2.) | - |
| maxSize | false | 104857600 | Maximum total size of the JSON document in bytes. The limit is per document, so in a multipart body it applies to each JSON part separately rather than to the whole upload. To cap the size of the entire request, use the limit plugin with its maxBodyLength attribute. A value of -1 disables the limit. | - |
| maxStringLength | false | 262144 | Maximum string length. For example, {"abcd": "efgh", "ijkl": [ "mnop" ], "qrst": { "uvwx": 1}} has a maximum string length of 4. (In this example, all 6 strings effectively have length 4.)The maximum string length also affects keys ("abcd", "ijkl", "qrst" and "uvwx" in the example). The keys can be also limited by the separate property maxKeyLength. The stricter limit applies. | - |
| maxTokens | false | 10000 | Maximum number of tokens a JSON document may consist of. For example, {"a":"b"} counts as 3. | - |
| otherContentTypes | false | REJECT | What to do with content this plugin does not inspect. This applies both to the body of a request of another type and to the individual parts of a multipart body, so skip allows e.g. an image to be uploaded alongside the document that is checked.Values: REJECT, SKIP | SKIP |
| reportError | false | Depends on production configuration. In production mode default is false otherwise true. | Overwrites default error reporting behaviour. If set to true, errors will provide ProblemDetails body, if set to false, errors will throw exceptions resulting in 400 Bad Request responses without any details. | - |