Rejecting requests with significant content length is a good practice to control the network traffic intensity and thus resource consumption in order to prevent DoS attacks.

## Ask Yourself Whether

- size limits are not defined for the different resources of the web application.
- the web application is not protected by rate limiting features.
- the web application infrastructure has limited resources.

There is a risk if you answered yes to any of those questions.

## Recommended Secure Coding Practices

- For most of the features of an application, it is recommended to limit the size of requests to:
  - lower or equal to 8mb for file uploads.
  - lower or equal to 2mb for other requests.

It is recommended to customize the rule with the limit values that correspond to the web application.

## Sensitive Code Example

For Symfony Constraints:

    use Symfony\Component\Validator\Constraints as Assert;
    use Symfony\Component\Validator\Mapping\ClassMetadata;

    class TestEntity
    {
        public static function loadValidatorMetadata(ClassMetadata $metadata)
        {
            $metadata->addPropertyConstraint('upload', new Assert\File([
                'maxSize' => '100M', // Sensitive
            ]));
        }
    }

For Laravel Validator:

    use App\Http\Controllers\Controller;
    use Illuminate\Http\Request;

    class TestController extends Controller
    {
        public function test(Request $request)
        {
            $validatedData = $request->validate([
                'upload' => 'required|file', // Sensitive
            ]);
        }
    }

## Compliant Solution

For Symfony Constraints:

    use Symfony\Component\Validator\Constraints as Assert;
    use Symfony\Component\Validator\Mapping\ClassMetadata;

    class TestEntity
    {
        public static function loadValidatorMetadata(ClassMetadata $metadata)
        {
            $metadata->addPropertyConstraint('upload', new Assert\File([
                'maxSize' => '8M', // Compliant
            ]));
        }
    }

For Laravel Validator:

    use App\Http\Controllers\Controller;
    use Illuminate\Http\Request;

    class TestController extends Controller
    {
        public function test(Request $request)
        {
            $validatedData = $request->validate([
                'upload' => 'required|file|max:8000', // Compliant
            ]);
        }
    }

## See

- OWASP - Top 10 2021 Category A5 - Security Misconfiguration
- Owasp Cheat Sheet - Owasp Denial of Service Cheat Sheet
- OWASP - Top 10 2017 Category A6 - Security Misconfiguration
- CWE - CWE-770 - Allocation of Resources Without Limits or Throttling
- CWE - CWE-400 - Uncontrolled Resource Consumption