Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
MIME-Version: 1.0
In-Reply-To: <2C95F28B-EF18-449D-BB57-4C9E243C9F68@apache.org>
References: 
 <CALOE=ztNjXYqD-OY9W4unRQAV3VhY04tRH39hG7f8ZAEUTw3zA@mail.gmail.com>
	<A08F2080-11E9-41B4-9EF7-635F48DFDB2C@apache.org>
	<CALOE=zvXm1h+t8c70As4sAa56BmLJK7NKF=+2gZ19UnEZ92Akg@mail.gmail.com>
	<2C95F28B-EF18-449D-BB57-4C9E243C9F68@apache.org>
Date: Thu, 6 Sep 2012 21:27:50 +0200
Message-ID: 
 <CAL+Y1ntSqhYbqLfY-so9Ee7b-c03voEQb5dgxTmSrYaEBPP4uw@mail.gmail.com>
Subject: Re: Limiting doc size to prevent malicious use
From: Dave Cottlehuber <dch@jsonified.com>
To: user@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1

On 6 September 2012 20:50, Robert Newson <rnewson@apache.org> wrote:
> function(doc) {
>   if (JSON.stringify(doc).length > limit) {
>     throw({forbidden : "doc too big"
>   }
> }
>
> With the caveat that this is inefficient and horrible.
>
> B.

And from a network-based (D)DOS, the damage is already done because it
was sent & parsed muahahaha. But at least you'll not be storing that
in the DB.

Has anybody using nginx or apache to enforce a hard limit? e.g.
http://wiki.nginx.org/HttpCoreModule#client_max_body_size

A+
Dave