Skip to content

Requests over ng's form and multipart limits get a 500, not a 4xx #102

Open

Description

@hugithordarson

A request over one of ng's limits gets a 500 instead of a 4xx status.

The request parsing added under #66 enforces limits by throwing IllegalArgumentException:

  • NGStandardRequest.MAX_FORM_FIELDS (1000) and MAX_FORM_CONTENT_LENGTH (200,000 bytes) for form-encoded bodies and query strings;
  • NGMultipartRequest.Limits, set by the ng.multipart.* properties (maxParts, maxContentLength, maxMemoryPartLength), for collected multipart requests.

Dispatch turns any exception into the exception page, a 500. That's wrong for the client and noisy for the operator: it logs a stack trace for what is the client's error.

What's needed is a way for an exception to carry the status it should produce, for example an exception type with a status (NGHTTPStatusException( 413, "..." ) or similar) that dispatch maps to a plain response instead of the exception page:

  • 413 for content over a length limit;
  • 400 for too many fields or parts, or malformed content.

The same mechanism would serve other client errors that currently surface as 500s, such as the duplicate form value check in formValueForKey.

Jetty behaved the same before: its limits were exceptions inside the adaptor, which also became 500s.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions