Cap the size of every search

How to do it

Long input makes many terms, and each term adds index reads. Ranking reads the tsvector of every match, so a common word on a large table is slow. Check the length on the server before the query runs, and answer 400 with the limit. Ask for one hit more than the page size to know whether a next page exists, instead of counting every match. Page size caps come from Set a default page size and a maximum. Time limits come from Set time limits on every query. Request limits for search come from Limit requests per client.

Examples

JavaScript example

const MAX_QUERY_CHARACTERS = 200;
const MAX_SEARCH_DEPTH = 1000;
if (query.length > MAX_QUERY_CHARACTERS) return problem(400, `Search text is limited to ${MAX_QUERY_CHARACTERS} characters`);
if (offset + pageSize > MAX_SEARCH_DEPTH) return problem(400, `Search results stop at ${MAX_SEARCH_DEPTH} hits`);

Python example

MAX_QUERY_CHARACTERS = 200
MAX_SEARCH_DEPTH = 1000
if len(query) > MAX_QUERY_CHARACTERS:
    return problem(400, f"Search text is limited to {MAX_QUERY_CHARACTERS} characters")
if offset + page_size > MAX_SEARCH_DEPTH:
    return problem(400, f"Search results stop at {MAX_SEARCH_DEPTH} hits")

How to check

Send a search of 201 characters. The answer is 400 and names the limit. Ask for page 51 at 20 hits a page. The answer is 400 or an empty page, within the query time limit.

Sources

• PostgreSQL text search controls

Related rules

• Cap the page size in API design
• Set time limits on every query in Data
• Limit requests per client in Security testing