Basic

The request is an object with rules

The framework parses the request before the handler sees it. The parsing has rules, and the rules are the reason a malformed request never reaches the logic.

What you will see

One line. One field named is the claim the handler makes.

About 1 min of reading

Try It

Bound the parse

Write the limit

printf 'max_body_bytes 4096\n' > /tmp/l.txt; cat /tmp/l.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints

One line. The limit exists before the parse, which is the rule.

Attempt a larger body

printf 'bytes 90000\n' | awk '{print ($1>4096) ? "refuse" : "parse"}'

Before you run it, say out loud what it will print. Then open the answer.

What it prints

refuse. The refusal is a 413, and the 413 is the limit speaking.

Name the field read

printf 'handler reads=name only\n' > /tmp/f.txt; cat /tmp/f.txt

Before you run it, say out loud what it will print. Then open the answer.

What it prints

One line. One field named is the claim the handler makes.

Data Flow

A request to a parsed object

1 The content type is checked

↓

2 The size is checked against the limit

↓

3 The body is parsed once

↓

4 The handler reads named fields

Why this works

Why the handler reads only what it needs

Reading the whole request is reading what may be wrong. Reading one field is a claim about one field.

The symptom of an unbounded parse

A process that grows on one request. The growth names the parse, and the parse names the route.

Examples

Content type is checked

A body that is not JSON fails before the handler runs. The failure is a 415, and the 415 names the type.

The parse is not free

A large body is parsed into a large object. The size is the thing that must be bounded before the parse.

Why the rules are not trusted blindly

The rules are a version. A rule that changed in an upgrade is a rule the code assumed did not change.

Words this lesson uses

Each one is defined here on this site. Open the entry for the full definition and the other words it points at.

← A route is a registration

Previous Lesson

A route is a registration

Next Lesson

Responses are built, not returned

Responses are built, not returned →