There's a recommendation on openapi scanner sites: set a min and max expected length of responses. Is this supposed to prevent me from sending requests 1 TB in length or something? Is there any reason why I shouldn't just set it to something like 1000 (or even 1000000) characters if it's not static string length? Computers are pretty good at shuffling text around.
Does it think I'm running a C API behind it and used statically allocated arrays or something? Seems kinda silly...
Right, but that's not really a "security" issue. I'd say 1 MB would be a limit I'd probably never hit for what I'm doing, 1K if I want to be stingy. High server costs aren't really a 'security issue' either as the site presents it.
@nobody It's not great, for sure, but I would define a security issue as something that allows for arbitrary code execution, leaks data, installs a cryptominer, installs some other malware/backdoor, etc.
@nobody A service issue, yes, but not "security", unless it causes some other bug
The reason why it's a distinction is, if I drop the ball on security, my users are the victims, if I get DDoSed it hurts me, but they just get an outage
Well, if someone hacks my bank account and empties it, I call that a security issue. If they do the same by abusing my service maliciously, I call that a security issue too.
It's possible that it isn't an issue for you (perhaps because you're rich), but for some people it will be.
DDoS / abuse isn't solved by setting a max field length though, a bad person could send 1 trillion 10 kb messages an hour from a zombie cluster and have the same effect
There's sensible cases, if you're just sending a phone number it shouldn't be 10^345 digits long, but when it comes to file-like things, or flexible length things, it gets harder to say what that "upper limit" ought to be. If it's a DDoS concern I can pretty confidently say even 1 MB is probably not going to sink my server, but if it's some kind of thing like "<some HTTP Server> has been known to have memory corruption with requests longer than 1024 bytes" that's something else