Cap the size of every request and answer

How to do it

Cap list pages, for example at 100 items, whatever the client asks for. Limit request bodies, for example to 1 MB for JSON, and uploads. Give each request and each database query a server-side time limit, set as timeouts says. For GraphQL, limit depth and cost. Avoid regular expressions with nested repeats on user input, or use an engine that runs in linear time, such as RE2. Memory and process caps for the whole service are in set limits on memory and processes.

Example

GET /api/products?limit=1000000   → 100 items, next page link
POST /api/notes with a 50 MB body → 413 Content Too Large

const MAX_PAGE_SIZE = 100;
app.use(express.json({ limit: '1mb' }));
const pageSize = Math.min(Math.max(Number.parseInt(req.query.limit, 10) || 20, 1), MAX_PAGE_SIZE);

MAX_PAGE_SIZE = 100
app.config["MAX_CONTENT_LENGTH"] = 1024 * 1024  # Flask answers 413 above this
page_size = min(max(request.args.get("limit", 20, type=int), 1), MAX_PAGE_SIZE)

How to check

Ask for ?limit=1000000 and send a body over the limit. The server returns at most the cap, or answers 413, and stays fast. Send aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa! to every field checked by a pattern. Each reply comes back within a second.