3. Security and Validation

limit

Version

Enforces a maximum body size, rejecting oversized messages with a Problem Details 400 response.

If a Content-Length header is already present and exceeds the limit, the message is rejected immediately without reading the body. Otherwise body bytes are counted lazily as they stream through; the limit is applied to the decoded (uncompressed) byte count, so Content-Encoding compression (gzip, brotli, deflate) cannot be used to bypass it. When decoding is applied, Content-Encoding and Content-Length are removed from the forwarded message because the decoded size is not known ahead of time.

Due to Membrane's streaming architecture, request headers may already have been forwarded to the backend when the limit is exceeded mid-body; in that case the backend connection is closed.

See tutorials/security/100-SQL-Injection-Protection.yaml.

Example Configuration

api:
port: 2000
flow:
- limit:
maxBodyLength: 10485760
api:
   port: 2000
   flow:
     - limit:
         maxBodyLength: 10485760

Syntax

limit:
maxBodyLength: <number>
limit:
  maxBodyLength: <number>

Attributes

NameRequiredDefaultDescriptionExamples
maxBodyLengthfalse-1Maximum body size in bytes, measured against the decoded (uncompressed) content. Set to -1 to disable the limit.10485760

Can be used in