{"record":{"id":"2f60945b1862e629","repo":"crowdsecurity/crowdsec","slug":"body-size-exceeds-max-body-size-d","errorCode":null,"errorMessage":"body size exceeds max body size: %d","messagePattern":"body size exceeds max body size: (.+?)","errorType":"http","errorClass":null,"httpStatus":413,"severity":"error","filePath":"pkg/acquisition/modules/http/run.go","lineNumber":53,"sourceCode":"\t\t\treturn errors.New(\"invalid basic auth\")\n\t\t}\n\t}\n\n\tif hc.AuthType == \"headers\" {\n\t\tfor key, value := range hc.Headers {\n\t\t\tif r.Header.Get(key) != value {\n\t\t\t\treturn errors.New(\"invalid headers\")\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc rejectBody(w http.ResponseWriter, err error) error {\n\tif maxBytesErr, ok := errors.AsType[*http.MaxBytesError](err); ok {\n\t\tw.WriteHeader(http.StatusRequestEntityTooLarge)\n\t\treturn fmt.Errorf(\"body size exceeds max body size: %d\", maxBytesErr.Limit)\n\t}\n\n\tw.WriteHeader(http.StatusBadRequest)\n\n\treturn fmt.Errorf(\"failed to read body: %w\", err)\n}\n\nfunc (s *Source) processRequest(w http.ResponseWriter, r *http.Request, hc *Configuration, out chan pipeline.Event) error {\n\t// Shortcut for clients announcing an oversized body, so we don't read it at all.\n\tif hc.MaxBodySize != nil && r.ContentLength > *hc.MaxBodySize {\n\t\tw.WriteHeader(http.StatusRequestEntityTooLarge)\n\t\treturn fmt.Errorf(\"body size exceeds max body size: %d > %d\", r.ContentLength, *hc.MaxBodySize)\n\t}\n\n\tsrcHost, _, err := net.SplitHostPort(r.RemoteAddr)\n\tif err != nil {\n\t\treturn err\n\t}","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/run.go#L35-L71","documentation":"rejectBody converts an *http.MaxBytesError (returned when the request body exceeds the configured MaxBodySize) into this error while responding to the client with HTTP 413. It is the datasource's way of aborting ingestion of an oversized payload.","triggerScenarios":"A client POSTs to the http datasource's endpoint and the body read hits the http.MaxBytesReader limit set from hc.MaxBodySize; processRequest calls rejectBody with the MaxBytesError.","commonSituations":"A log shipper or CI system posts a very large batch (big JSON array, large dump) while the datasource config sets a small max_body_size; default limits rejecting legitimate bulk uploads.","solutions":["Raise max_body_size in the http datasource configuration to accommodate your largest expected payload.","Split or batch the client's payload into smaller requests below the limit.","Compress the payload (gzip) before sending if the client supports it.","Verify with the trace log which limit was hit — the message contains the exact byte limit."],"exampleFix":"# before\nmax_body_size: 1M\n# after\nmax_body_size: 10M","handlingStrategy":"validation","validationCode":"if len(payload) > maxBodySize { return errors.New(\"payload too large for datasource max_body_size\") }","typeGuard":null,"tryCatchPattern":"if resp.StatusCode == http.StatusRequestEntityTooLarge { // shrink batch and retry }","preventionTips":["Size max_body_size above your largest expected batch.","Batch client uploads.","Monitor for 413 responses in client metrics."],"tags":["http","payload","limit"],"backgroundTag":"payload-too-large","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}