{"record":{"id":"c1653dea48cfa430","repo":"crowdsecurity/crowdsec","slug":"body-size-exceeds-max-body-size-d-d","errorCode":null,"errorMessage":"body size exceeds max body size: %d > %d","messagePattern":"body size exceeds max body size: (.+?) > (.+?)","errorType":"http","errorClass":null,"httpStatus":413,"severity":"error","filePath":"pkg/acquisition/modules/http/run.go","lineNumber":65,"sourceCode":"\treturn nil\n}\n\nfunc rejectBody(w http.ResponseWriter, err error) error {\n\tif maxBytesErr, ok := errors.AsType[*http.MaxBytesError](err); ok {\n\t\tw.WriteHeader(http.StatusRequestEntityTooLarge)\n\t\treturn fmt.Errorf(\"body size exceeds max body size: %d\", maxBytesErr.Limit)\n\t}\n\n\tw.WriteHeader(http.StatusBadRequest)\n\n\treturn fmt.Errorf(\"failed to read body: %w\", err)\n}\n\nfunc (s *Source) processRequest(w http.ResponseWriter, r *http.Request, hc *Configuration, out chan pipeline.Event) error {\n\t// Shortcut for clients announcing an oversized body, so we don't read it at all.\n\tif hc.MaxBodySize != nil && r.ContentLength > *hc.MaxBodySize {\n\t\tw.WriteHeader(http.StatusRequestEntityTooLarge)\n\t\treturn fmt.Errorf(\"body size exceeds max body size: %d > %d\", r.ContentLength, *hc.MaxBodySize)\n\t}\n\n\tsrcHost, _, err := net.SplitHostPort(r.RemoteAddr)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// Content-Length can be absent (chunked, HTTP/2) or a lie, so bound what we actually read.\n\t// This also caps gzip streams that consume input without producing output.\n\tif hc.MaxBodySize != nil {\n\t\tr.Body = http.MaxBytesReader(w, r.Body, *hc.MaxBodySize)\n\t}\n\n\tdefer r.Body.Close()\n\n\tif s.logger.Logger.IsLevelEnabled(log.TraceLevel) {\n\t\ts.logger.Tracef(\"processing request from '%s' with method '%s' and path '%s'\", r.RemoteAddr, r.Method, r.URL.Path)\n","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/run.go#L47-L83","documentation":"processRequest pre-checks the declared Content-Length against the configured MaxBodySize before reading anything, returning 413 to the client with this error naming both the declared size and the limit.","triggerScenarios":"Client sends a request with Content-Length greater than hc.MaxBodySize (both non-nil); the check runs before any body bytes are read.","commonSituations":"Bulk log exporters posting very large JSON payloads to a datasource configured with a conservative max_body_size; misconfigured clients sending entire log files in one request.","solutions":["Increase max_body_size in the datasource configuration.","Have the client batch/chunk requests so each Content-Length is under the limit.","Configure the client to stream with chunked encoding (no Content-Length) only if the limit is meant to apply to actual bytes — note the MaxBytesReader still enforces it on read.","Drop explicit Content-Length mismatch by fixing the client's pre-computed length if it is wrong."],"exampleFix":"// client before\nbody, _ := json.Marshal(allEvents)\n// after (batching)\nfor _, batch := range chunk(allEvents, 1000) { post(json.Marshal(batch)) }","handlingStrategy":"validation","validationCode":"if r.ContentLength > maxBodySize { // do not send; split batch first }","typeGuard":null,"tryCatchPattern":"if resp.StatusCode == http.StatusRequestEntityTooLarge { splitBatchAndRetry() }","preventionTips":["Pre-check Content-Length client-side before POSTing.","Keep request sizes well under the configured limit.","Document the expected payload ceiling for integrators."],"tags":["http","payload","limit"],"backgroundTag":"payload-too-large","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}