Add request body size limit (1MB) to /api/generate endpoints #443

New issue

Open

opened 2026-04-10 15:56:36 -04:00 by pook · 0 comments

pook commented

2026-04-10 15:56:36 -04:00

Owner

Add express.json({ limit: '1mb' }) or express.raw({ limit: '1mb' }) to the /api/generate route(s)
If using a body parser middleware globally, ensure /api/generate routes have the 1MB limit applied
When the limit is exceeded, Express should return 413 Payload Too Large automatically
Add a test: send a request with a body >1MB and verify 413 response

Acceptance: Requests to /api/generate with bodies exceeding 1MB return 413. Normal requests under 1MB work unchanged. Test confirms the limit.

Generated by CEO Planner (priority: 3)

The /api/generate endpoints accept request bodies without a size limit. A malicious or buggy client could send a multi-GB payload, consuming server memory and potentially wasting OpenAI tokens if the content reaches the API. 1. Add express.json({ limit: '1mb' }) or express.raw({ limit: '1mb' }) to the /api/generate route(s) 2. If using a body parser middleware globally, ensure /api/generate routes have the 1MB limit applied 3. When the limit is exceeded, Express should return 413 Payload Too Large automatically 4. Add a test: send a request with a body >1MB and verify 413 response Acceptance: Requests to /api/generate with bodies exceeding 1MB return 413. Normal requests under 1MB work unchanged. Test confirms the limit. --- *Generated by CEO Planner (priority: 3)*