Repository navigation
Answer 413 for an oversized request body under Draft20260903 - #10440
Merged
Merged
Conversation
github-actions
Bot
added
📚 documentation
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
An unresolved moderate issue can return 200 for oversized requests accepting streaming formats, and two documentation qualifications are needed.
Review effort: Lite
Findings: 2
Open (2)
What changed in this PR
Updates oversized JSON request handling to return 413 with HC0010 under Draft20260903, while preserving older transport behavior.
Changes:
- Adds request-size classification and formatter status mapping.
- Updates parser messaging and transport tests.
- Documents revised HTTP and Fusion behavior.
| File | Summary |
|---|---|
website/content/docs/hotchocolate/server/http-transport.md |
Documents revised oversized-request status behavior. |
website/content/docs/hotchocolate/server/endpoints.md |
Documents HC0010 and 413; should qualify behavior to JSON request bodies. |
website/content/docs/fusion/request-limits.md |
Documents Fusion request limits; should qualify behavior to JSON request bodies. |
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/GraphQLOverHttpSpecTests.cs |
Adds transport-specific oversized-request coverage. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Utilities/MiddlewareHelper.cs |
Marks oversized parser results for formatting. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Utilities/HttpResultContextData.cs |
Adds oversized-request context metadata. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Properties/AspNetCorePipelineResources.resx |
Updates the request-size error message. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Parsers/DefaultHttpRequestParser.cs |
Produces the coded size-limit error. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Formatters/DefaultHttpResponseFormatter.cs |
Maps applicable oversized requests to 413; streaming formats currently bypass this conversion. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Patch coverage100.0% of changed lines covered (13/13)
Project coverage: 58.8% (298858/508067 lines) |
This was referenced Oct 25, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Draft20260903, a POST, persisted-operation POST, or QUERY request whose JSON body exceedsmaxAllowedRequestSizeanswers413, as the GraphQL over HTTP draft asks: "If the size of thePOSTrequest body was too large, status code413SHOULD be used."LegacyandDraft20250508keep their answers,200forapplication/jsonunderLegacyand400otherwise.HC0010code under every transport version, because the parser now throws throughThrowHelper.DefaultHttpRequestParser_MaxRequestSizeExceeded. The message stays "Request size exceeds maximum allowed size.", so the helper's resource text was changed to it. The newcodeextension is worth a release-note line.400and marks the result with an internal context-data key, which the default formatter maps to413. A custom formatter that overridesOnDetermineStatusCodereceives the same proposal as before.FormOptionsrather thanmaxAllowedRequestSize, and keep their current answer.Test plan
GraphQLOverHttpSpecTestspin the POST, persisted-operation POST, and QUERY answers per transport version against a server configured withAddGraphQLServer(maxAllowedRequestSize: 256), including the error body withHC0010.HotChocolate.AspNetCore.Tests,HotChocolate.Language.Web.Tests,HotChocolate.Transport.Http.Tests, andHotChocolate.Fusion.AspNetCore.Testspass on net10.0, andGraphQLOverHttpSpecTestspasses on net8.0 and net11.0.