{"record":{"id":"3d4e4acc325ab170","repo":"argoproj/argo-workflows","slug":"webhook-request-body-exceeds-maximum-size-of-2mb","errorCode":null,"errorMessage":"webhook request body exceeds maximum size of 2MB","messagePattern":"webhook request body exceeds maximum size of 2MB","errorType":"validation","errorClass":null,"httpStatus":413,"severity":"warning","filePath":"server/auth/webhook/interceptor.go","lineNumber":86,"sourceCode":"\t}\n\tnamespace := parts[0]\n\tsecretsInterface := kube.CoreV1().Secrets(namespace)\n\tctx := r.Context()\n\n\twebhookClients, err := secretsInterface.Get(ctx, \"argo-workflows-webhook-clients\", metav1.GetOptions{})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to get webhook clients: %w\", err)\n\t}\n\t// we need to read the request body to check the signature, but we still need it for the GRPC request,\n\t// so read it all now, and then reinstate when we are done.\n\t// Limit to 2MB to prevent denial-of-service via oversized webhook payloads.\n\tconst maxWebhookSize = 2 * 1024 * 1024 // 2MB\n\tbuf, err2 := io.ReadAll(io.LimitReader(r.Body, maxWebhookSize+1))\n\tif err2 != nil {\n\t\treturn fmt.Errorf(\"failed to read webhook request body: %w\", err2)\n\t}\n\tif len(buf) > maxWebhookSize {\n\t\treturn fmt.Errorf(\"webhook request body exceeds maximum size of 2MB\")\n\t}\n\tdefer func() { r.Body = io.NopCloser(bytes.NewBuffer(buf)) }()\n\tserviceAccountInterface := kube.CoreV1().ServiceAccounts(namespace)\n\tfor serviceAccountName, data := range webhookClients.Data {\n\t\tr.Body = io.NopCloser(bytes.NewBuffer(buf))\n\t\tclient := &webhookClient{}\n\t\terr := yaml.Unmarshal(data, client)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to unmarshal webhook client \\\"%s\\\": %w\", serviceAccountName, err)\n\t\t}\n\t\ti.logger.WithFields(logging.Fields{\"serviceAccountName\": serviceAccountName, \"webhookType\": client.Type}).Debug(r.Context(), \"Attempting to match webhook request\")\n\t\tok := webhookParsers[client.Type](client.Secret, r)\n\t\tif ok {\n\t\t\ti.logger.WithField(\"serviceAccountName\", serviceAccountName).Debug(r.Context(), \"Matched webhook request\")\n\t\t\tserviceAccount, err := serviceAccountInterface.Get(ctx, serviceAccountName, metav1.GetOptions{})\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to get service account \\\"%s\\\": %w\", serviceAccountName, err)\n\t\t\t}","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/server/auth/webhook/interceptor.go#L68-L104","documentation":"To prevent denial-of-service, the interceptor caps webhook bodies at 2MB. If the buffered body exceeds maxWebhookSize the request is rejected outright with this static error — no signature verification is attempted.","triggerScenarios":"A POST to a webhook endpoint whose payload (e.g. a GitHub push event with a huge diff/payload or misconfigured sender) exceeds 2*1024*1024 bytes, so io.LimitReader(…, max+1) reads more than 2MB.","commonSituations":"Git providers sending very large push events; misconfigured webhooks sending full artifact contents; a client using the webhook route for non-webhook data uploads.","solutions":["Reduce webhook payload size on the sender side (configure the Git host to send minimal event payloads)","Ensure the webhook URL is only receiving intended provider events (limit event types)","If legitimately larger payloads are needed, this is a hard-coded limit — file an issue / adjust the constant and rebuild","Confirm no client is accidentally posting large files to the webhook route"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if r.ContentLength > 2*1024*1024 {\n    http.Error(w, \"webhook request body exceeds maximum size of 2MB\", http.StatusRequestEntityTooLarge)\n    return\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Limit event types subscribed on the Git provider webhook","Keep push payloads small (shallow diffs); avoid attaching artifacts","Reject oversized bodies early at the ingress with 413","Educate users that 2MB is a hard anti-DoS cap"],"tags":["webhook","limit","dos-protection"],"backgroundTag":"payload-too-large","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}