Summary
Request body protection only checks the Content-Length header. If the client omits Content-Length or sends chunked transfer encoding, oversized bodies can bypass the limit.
Why this matters
The README already calls this out as a limitation, but it leaves a gap in local safety for agent clients that stream bodies or omit length headers.
Relevant code
app/request_limits.py:40-69app/main.py:116-133README.md:216
Current behavior
reject_request_body_if_too_large() returns 413 only when declared_content_length() is present and above the threshold. When length is missing, it returns None.
Suggested fix
Enforce the size limit on the actual bytes read from the request stream, or add a fallback path that rejects oversized bodies even without Content-Length.
Tests
Add a regression test for a POST or PATCH request without Content-Length, and verify the limit is still enforced.
Summary
Request body protection only checks the
Content-Lengthheader. If the client omitsContent-Lengthor sends chunked transfer encoding, oversized bodies can bypass the limit.Why this matters
The README already calls this out as a limitation, but it leaves a gap in local safety for agent clients that stream bodies or omit length headers.
Relevant code
app/request_limits.py:40-69app/main.py:116-133README.md:216Current behavior
reject_request_body_if_too_large()returns413only whendeclared_content_length()is present and above the threshold. When length is missing, it returnsNone.Suggested fix
Enforce the size limit on the actual bytes read from the request stream, or add a fallback path that rejects oversized bodies even without
Content-Length.Tests
Add a regression test for a
POSTorPATCHrequest withoutContent-Length, and verify the limit is still enforced.