{"record":{"id":"6909f9ecc9a07f7b","repo":"JuliusBrussee/caveman","slug":"kms-s-response-exceeds-limit","errorCode":null,"errorMessage":"kms: %s response exceeds limit","messagePattern":"kms: (.+?) response exceeds limit","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"shared/platform/kms/kms.go","lineNumber":374,"sourceCode":"\t}\n\treq.Header.Set(\"content-type\", \"application/json\")\n\treq.Header.Set(\"accept\", \"application/json\")\n\treq.Header.Set(\"x-auth-token\", c.token)\n\tresp, err := c.httpClient.Do(req)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: %s request failed: %w\", operation, err)\n\t}\n\tdefer resp.Body.Close()\n\tif resp.StatusCode != http.StatusOK {\n\t\t_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 32<<10))\n\t\treturn fmt.Errorf(\"kms: %s returned HTTP %d\", operation, resp.StatusCode)\n\t}\n\tdata, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBytes+1))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: read %s response: %w\", operation, err)\n\t}\n\tif len(data) > maxResponseBytes {\n\t\treturn fmt.Errorf(\"kms: %s response exceeds limit\", operation)\n\t}\n\tif err := json.Unmarshal(data, output); err != nil {\n\t\treturn fmt.Errorf(\"kms: decode %s response: %w\", operation, err)\n\t}\n\treturn nil\n}\n","sourceCodeStart":356,"sourceCodeEnd":381,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/shared/platform/kms/kms.go#L356-L381","documentation":"The KMS response body exceeded maxResponseBytes. The client reads at most maxResponseBytes+1 bytes and fails closed if more data arrives, protecting against hostile or buggy servers returning unbounded payloads. The response was valid HTTP 200 but too large to trust.","triggerScenarios":"Encrypt or Decrypt calls where the KMS server returns a body larger than the configured maxResponseBytes: a misbehaving/compromised KMS endpoint, a proxy returning an HTML error page inflated beyond the limit, or a maxResponseBytes configured too small for legitimate large ciphertexts.","commonSituations":"Pointing the KMS client at a wrong endpoint that streams large HTML pages, extremely large plaintext/ciphertext legitimately exceeding the default cap, or testing against a mock server that ignores size constraints.","solutions":["Check what the server is actually returning (curl the endpoint) — an HTML error/proxy page means the endpoint config is wrong.","If the payload is legitimately large, raise maxResponseBytes in the client configuration.","Verify you are talking to the real KMS API and not a gateway/error interstitial.","Keep the limit in place for untrusted networks; only raise it to a value bounded by your threat model.","Log the Content-Length header server-side to distinguish genuine large payloads from garbage."],"exampleFix":"// before\nclient := kms.NewClient(kms.WithMaxResponseBytes(64<<10)) // Decrypt of 100KB ciphertext fails\n// after\nclient := kms.NewClient(kms.WithMaxResponseBytes(1<<20)) // sized to largest legitimate payload","handlingStrategy":"validation","validationCode":"// size the limit before constructing the client\nmaxPayload := largestLegitimateCiphertextBytes() // measure from your workload\nif maxPayload > defaultMaxResponseBytes {\n    client = kms.NewClient(kms.WithMaxResponseBytes(maxPayload + slack))\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"response exceeds limit\") {\n    // log body size from server metrics; verify endpoint identity before raising limit\n    return fmt.Errorf(\"KMS response suspiciously large; verify endpoint: %w\", err)\n}","preventionTips":["Only raise maxResponseBytes to a measured, bounded value.","Verify the endpoint URL when this error appears — proxies returning HTML pages commonly trip it.","Keep the limit enabled in untrusted-network deployments; it is a DoS guard.","Log Content-Length from the server to distinguish legitimate large payloads."],"tags":["kms","limits","security","go"],"backgroundTag":"payload-too-large","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}