The request_size_limiter plugin enforces strict request size boundaries for incoming HTTP requests to protect services from oversized payloads, abuse, and resource exhaustion.

​
Size Limits

The plugin can limit the following parts of the request:

Request PartDescriptionDefault
HeadersTotal headers size8KB
BodyRequest body size1MB
URLURL length2KB
Header CountNumber of headers100

​
Configuration

{
  "name": "request_size_limiter",
  "enabled": true,
  "stage": "pre_request",
  "settings": {
    "max_header_size": 8192,
    "max_body_size": 1048576,
    "max_url_length": 2048,
    "max_header_count": 100,
    "error_message": "Request size exceeds limit"
  }
}

​
Configuration Parameters

ParameterTypeDescriptionRequiredDefault
max_header_sizenumberMaximum headers size in bytesNo8192
max_body_sizenumberMaximum body size in bytesNo1048576
max_url_lengthnumberMaximum URL length in bytesNo2048
max_header_countnumberMaximum number of headersNo100
error_messagestringCustom error messageNo”Request size exceeds limit”

​
Character-Based Limits

In addition to byte-based limits, the plugin supports request character limits and optional enforcement of the Content-Length header.

ParameterTypeDescriptionDefault
allowed_payload_sizenumberPayload size threshold (unit configurable)10MB
size_unitstringSize unit: bytes, kilobytes, or megabytesmegabytes
max_chars_per_requestnumberMax allowed characters per request100,000
require_content_lengthbooleanWhether Content-Length header must be presentfalse

​
Response Headers

On success, the plugin returns informational headers:

Header NameDescription
X-Request-Size-BytesActual request size in bytes
X-Request-Size-CharsNumber of characters in the request
X-Size-Limit-BytesConfigured max size limit in bytes
X-Size-Limit-CharsConfigured max character count limit

​
Usage Example

curl -X POST "http://localhost:8080/api/v1/gateways" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Size Limited Gateway",
    "subdomain": "size-limited",
    "required_plugins": [
      {
        "name": "request_size_limiter",
        "enabled": true,
        "stage": "pre_request",
        "settings": {
          "max_header_size": 8192,
          "max_body_size": 1048576,
          "max_url_length": 2048,
          "max_header_count": 100
        }
      }
    ]
  }'

​
Behavior Summary

  • Validates size and character limits against configured thresholds
  • Supports size units: bytes, kilobytes, megabytes
  • Blocks request with HTTP 413 Payload Too Large when limits are exceeded
  • Optionally enforces presence of Content-Length
  • Adds response headers with diagnostics
  • Provides clear error messages for violations