Re: [soaplite] Re: $My::SOAP::Transport::CGI::POST_MAX = 100 * 1024
- Thinking about this a bit more, I'm not sure of the usefulness of
checking content-length at this stage - it may be too late.
What's the motivation? To stop deliberate attempts to overload/crash
the SOAP application? By the time the CGI application runs, the http
server has probably read all the request anyway. Maybe it's the http
server which needs to have limit applied?
However I notice that CGI.pm has a similar idea, $CGI::POST_MAX,
so perhaps it's a sound idea.
On 2002-01-21 Paul Kulchenko <paulclinger@...> wrote:
>--- aaron_of_montreal <aaron_of_montreal@...> wrote:
>> That's what I thought, originally, but decided to err on the side
>> of paranoia :
>> "The Content-length header specifies the length of the data (in
>> that is returned by the client-specified URL. Due to the dynamic
>> nature of some requests, the Content-length is sometimes unknown,
>> and this header might be omitted." 
>>From the context it seems like this text applies to server side,
>rather than to client side, so Duncan's code should be sufficient in
>most if not all cases.
>The only problem that I currently have is whether I should return
>HTTP error (for example: "413 Request Entity Too Large") or SOAP
>fault. I can also generate "411 Length Required" when there is no
>Best wishes, Paul.
- Hi, Duncan!
--- Duncan Cameron <dcameron@...> wrote:
> What's the motivation? To stop deliberate attempts tothe
> the SOAP application? By the time the CGI application runs, the
> http server has probably read all the request anyway. Maybe it's
> http server which needs to have limit applied?No, server shouldn't read all the request at this point. In most
cases it'll just redirect STDIN/STDOUT, so CGI application will get
the request by reading its STDIN.
> However I notice that CGI.pm has a similar idea, $CGI::POST_MAX,Yes, because it's CGI app's responsibility to read and handle the
> so perhaps it's a sound idea.
Best wishes, Paul.
Do You Yahoo!?
Send FREE video emails in Yahoo! Mail!
- --- In soaplite@y..., Paul Kulchenko <paulclinger@y...> wrote:
> The only problem that I currently have is whether I should returnIf you follow the examples set by CGI.pm and the "Contentious Issues"
> HTTP error (for example: "413 Request Entity Too Large") or SOAP
section of the SOAP book, wouldn't you do both? e.g. return the fault,
but set the reponse code to 413.
> fault. I can also generate "411 Length Required" when there is noI guess my preference would be to actually read/count the bytes since
> Content-length header.
the Content-length header could, arguably, be tweaked and not match
the actual size of the request.
If returning a 411 code is the "Right Thing" to do then I can deal but
I am more concerned with how much data is really being read from