---
title: "Cap the size of every request and answer · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/resource-limits
updated: 2026-10-20
licence: "All rights reserved"
---

# Cap the size of every request and answer

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)
- Rule: Put a ceiling on everything a client can make the server do, such as page sizes, upload sizes, query depth and pattern matching time.
- How: Cap list pages, for example at 100 items, whatever the client asks for. Limit request bodies, for example to 1 MB for JSON, and uploads. Give each request and each database query a server-side time limit, set as [timeouts](https://agentwranglers.se/playbook/api-design/reliability/timeouts) says. For GraphQL, limit depth and cost. Avoid regular expressions with nested repeats on user input, or use an engine that runs in linear time, such as RE2. Memory and process caps for the whole service are in [set limits on memory and processes](https://agentwranglers.se/playbook/operations/running-the-service/resource-limits).
- Check: Ask for `?limit=1000000` and send a body over the limit. The server returns at most the cap, or answers 413, and stays fast. Send `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!` to every field checked by a pattern. Each reply comes back within a second.

Example:

```text
GET /api/products?limit=1000000   → 100 items, next page link
POST /api/notes with a 50 MB body → 413 Content Too Large
```

```js
const MAX_PAGE_SIZE = 100;
app.use(express.json({ limit: '1mb' }));
const pageSize = Math.min(Math.max(Number.parseInt(req.query.limit, 10) || 20, 1), MAX_PAGE_SIZE);
```

```python
MAX_PAGE_SIZE = 100
app.config["MAX_CONTENT_LENGTH"] = 1024 * 1024  # Flask answers 413 above this
page_size = min(max(request.args.get("limit", 20, type=int), 1), MAX_PAGE_SIZE)
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/resource-limits`.

- Previous: [Make each change happen exactly once](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/race-conditions)
- Next: [Stop spam and fake sign-ups](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/form-spam)
- [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)