There's a recommendation on openapi scanner sites: set a min and max expected length of responses. Is this supposed to prevent me from sending requests 1 TB in length or something? Is there any reason why I shouldn't just set it to something like 1000 (or even 1000000) characters if it's not static string length? Computers are pretty good at shuffling text around.

Does it think I'm running a C API behind it and used statically allocated arrays or something? Seems kinda silly...

I don't think that's the case...depending on your side, 1TB of traffic can be costy

Right, but that's not really a "security" issue. I'd say 1 MB would be a limit I'd probably never hit for what I'm doing, 1K if I want to be stingy. High server costs aren't really a 'security issue' either as the site presents it.

chat.stackexchange.com/transcript/message/59598842#59598842 @forest do you have a link for this? Mailing list / etc? I haven't heard about this.

@jrh Why would you say high server costs aren't a security issue?

@nobody It's not great, for sure, but I would define a security issue as something that allows for arbitrary code execution, leaks data, installs a cryptominer, installs some other malware/backdoor, etc.

@jrh Would you call a denial of service attack a service issue?

Because this is worse than a simple dos, it causes real damage to you.

@nobody A service issue, yes, but not "security", unless it causes some other bug

Well, depending on the the service, an outage can cause significant issues for users

It gets interesting when the service is critical and downtime is dangerous, for the sake of simplifying things, let's say it's not safety critical

@jrh By your definition, running a cryptominer on your systems is also not a security issue :)

Because, the users don't get hurt

it's an easy example to type out, it could just as easily be a keylogger / data stealer / etc

the important part is "installs this thing on the server that does bad stuff"; kinda just an extension of ACE

Well, if someone hacks my bank account and empties it, I call that a security issue. If they do the same by abusing my service maliciously, I call that a security issue too.

It's possible that it isn't an issue for you (perhaps because you're rich), but for some people it will be.

DDoS / abuse isn't solved by setting a max field length though, a bad person could send 1 trillion 10 kb messages an hour from a zombie cluster and have the same effect

There's sensible cases, if you're just sending a phone number it shouldn't be 10^345 digits long, but when it comes to file-like things, or flexible length things, it gets harder to say what that "upper limit" ought to be. If it's a DDoS concern I can pretty confidently say even 1 MB is probably not going to sink my server, but if it's some kind of thing like "<some HTTP Server> has been known to have memory corruption with requests longer than 1024 bytes" that's something else