Skip to content

Harden webhook body limits and slow-client handling #38

Description

@concertypin

Deferred webhook hardening follow-up.

Scope:

  • Enforce actual webhook byte limits even when Content-Length is underdeclared.
  • Add idle and total receive deadlines for slow-but-continuously-uploading webhook bodies.

Current behavior:

  • Hono bodyLimit provides a fast Content-Length path and actual chunk counting when Content-Length is absent or transfer-encoded.
  • This is intentionally deferred while webhook traffic is low and there is no observed abuse.

Revisit when webhook traffic or abuse increases. Avoid intentionally burning CPU to force isolate replacement; use bounded streaming and explicit deadlines instead.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions