If a Content-Length header is already present and exceeds the limit, the message is rejected immediately without reading the body. Otherwise body bytes are counted lazily as they stream through; the limit is applied to the decoded (uncompressed) byte count, so Content-Encoding compression (gzip, brotli, deflate) cannot be used to bypass it. When decoding is applied, Content-Encoding and Content-Length are removed from the forwarded message because the decoded size is not known ahead of time.
Due to Membrane's streaming architecture, request headers may already have been forwarded to the backend when the limit is exceeded mid-body; in that case the backend connection is closed.
See tutorials/security/100-SQL-Injection-Protection.yaml.
Example Configuration
api:
port: 2000
flow:
- limit:
maxBodyLength: 10485760
api:
port: 2000
flow:
- limit:
maxBodyLength: 10485760
Syntax
limit:
maxBodyLength: <number>limit: maxBodyLength: <number>
Attributes
| Name | Required | Default | Description | Examples |
|---|---|---|---|---|
| maxBodyLength | false | -1 | Maximum body size in bytes, measured against the decoded (uncompressed) content. Set to -1 to disable the limit. | 10485760 |