fix(api_server): enforce chunked request body limits - #3949
Closed
Gutslabs wants to merge 1 commit into
Closed
Conversation
alt-glitch
added
P2
Collaborator
Collaborator
teknium1
pushed a commit
that referenced
this pull request
Jul 4, 2026
api_server already caps every read via client_max_size (chunked included), but when the limit tripped mid-read the handler's broad JSON except turned it into 400 'Invalid JSON'. Catch HTTPRequestEntityTooLarge in body_limit_middleware and return the OpenAI-style 413. Status-code polish extracted from PR #3949 by @Gutslabs — the PR's core client_max_size change already exists on main.
habarmc1223-sudo
pushed a commit
to habarmc1223-sudo/hermes-agent-fluxmem
that referenced
this pull request
Jul 8, 2026
api_server already caps every read via client_max_size (chunked included), but when the limit tripped mid-read the handler's broad JSON except turned it into 400 'Invalid JSON'. Catch HTTPRequestEntityTooLarge in body_limit_middleware and return the OpenAI-style 413. Status-code polish extracted from PR NousResearch#3949 by @Gutslabs — the PR's core client_max_size change already exists on main.
habarmc1223-sudo
pushed a commit
to habarmc1223-sudo/hermes-agent-fluxmem
that referenced
this pull request
Jul 8, 2026
…webhook-chunked-limit fix(gateway): enforce body-size limits on chunked requests (salvage NousResearch#3955 + NousResearch#3949)
Contributor
|
Thanks for the security report and regression coverage. This has already been implemented on
Automated hermes-sweeper review. |
teknium1
added
the
sweeper:implemented-on-main
santhreal
pushed a commit
to santhreal/hermes-agent
that referenced
this pull request
Jul 13, 2026
api_server already caps every read via client_max_size (chunked included), but when the limit tripped mid-read the handler's broad JSON except turned it into 400 'Invalid JSON'. Catch HTTPRequestEntityTooLarge in body_limit_middleware and return the OpenAI-style 413. Status-code polish extracted from PR NousResearch#3949 by @Gutslabs — the PR's core client_max_size change already exists on main.
santhreal
pushed a commit
to santhreal/hermes-agent
that referenced
this pull request
Jul 13, 2026
…webhook-chunked-limit fix(gateway): enforce body-size limits on chunked requests (salvage NousResearch#3955 + NousResearch#3949)
Gravezzz
pushed a commit
to Gravezzz/hermes-agent
that referenced
this pull request
Jul 21, 2026
api_server already caps every read via client_max_size (chunked included), but when the limit tripped mid-read the handler's broad JSON except turned it into 400 'Invalid JSON'. Catch HTTPRequestEntityTooLarge in body_limit_middleware and return the OpenAI-style 413. Status-code polish extracted from PR NousResearch#3949 by @Gutslabs — the PR's core client_max_size change already exists on main.
Gravezzz
pushed a commit
to Gravezzz/hermes-agent
that referenced
this pull request
Jul 21, 2026
…webhook-chunked-limit fix(gateway): enforce body-size limits on chunked requests (salvage NousResearch#3955 + NousResearch#3949)
leewenjie
pushed a commit
to leewenjie/hermes-agent
that referenced
this pull request
Aug 7, 2026
api_server already caps every read via client_max_size (chunked included), but when the limit tripped mid-read the handler's broad JSON except turned it into 400 'Invalid JSON'. Catch HTTPRequestEntityTooLarge in body_limit_middleware and return the OpenAI-style 413. Status-code polish extracted from PR NousResearch#3949 by @Gutslabs — the PR's core client_max_size change already exists on main.
leewenjie
pushed a commit
to leewenjie/hermes-agent
that referenced
this pull request
Aug 7, 2026
…webhook-chunked-limit fix(gateway): enforce body-size limits on chunked requests (salvage NousResearch#3955 + NousResearch#3949)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Fixes a request-size limit bypass in the API server.
The API server tried to reject oversized POST bodies early by checking
Content-Length, but chunked requests do not send that header. A client could send an oversized JSON body withTransfer-Encoding: chunkedand bypass the 1 MB limit entirely.This change enables aiohttp's real body-size limit, preserves the existing JSON 413 error envelope for oversized requests, and adds a regression test proving chunked requests no longer slip through.
Type of Change
Changes Made
client_max_size=MAX_REQUEST_BYTESon the API server app/v1/chat/completionsrequestsHow to Test
source .venv/bin/activatepython -m pytest tests/gateway/test_api_server.py -qTransfer-Encoding: chunkedto/v1/chat/completions413withcode: body_too_largeValidation
python -m pytest tests/gateway/test_api_server.py -q→89 passed/v1/chat/completionsreturned200413with the OpenAI-stylebody_too_largeerror payload