ory/kratos · error

identity schema rejected: body exceeds

Error message

identity schema rejected: body exceeds %d bytes

What it means

NewCompilerWithURL streams the schema body from the given URL through a LimitReader capped at MaxSchemaBodyBytes+1 specifically to prevent a malicious URL from OOMing kratos, and the read produced more than MaxSchemaBodyBytes bytes. The remote schema at the faulting input - the configured schema URL - is too large to be accepted.

Solutions

1. Reduce the schema size by removing unused definitions or splitting it
2. Inline only the needed subschemas instead of serving one giant document
3. Host the schema somewhere that can serve the trimmed version and update the URL

When it happens

Trigger: Thrown at schema/loader.go:78 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/492cbaf3cbf4d3c1. Report an issue: GitHub.

Appendix: source

Thrown at schema/loader.go:78

// regardless of disallowRefs). See NewCompiler for the semantics of
// disallowRefs.
func NewCompilerWithURL(ctx context.Context, schemaURL string, disallowRefs bool) (*jsonschema.Compiler, error) {
	ctx = ensureGuardedHTTPClient(ctx)

	resource, err := jsonschema.LoadURL(ctx, schemaURL)
	if err != nil {
		return nil, errors.WithStack(err)
	}
	defer func() { _ = resource.Close() }()

	// Read the body with a hard size cap so a malicious schema URL cannot
	// OOM kratos by returning a multi-GB body.
	data, err := io.ReadAll(io.LimitReader(resource, MaxSchemaBodyBytes+1))
	if err != nil {
		return nil, errors.WithStack(err)
	}
	if len(data) > MaxSchemaBodyBytes {
		return nil, errors.Errorf("identity schema rejected: body exceeds %d bytes", MaxSchemaBodyBytes)
	}

	// Decode once for structural prevalidation. The upstream compiler will
	// decode again from the same bytes — accepting a small CPU duplication
	// in exchange for the security gate.
	var doc any
	if err := json.Unmarshal(data, &doc); err != nil {
		return nil, errors.WithStack(err)
	}
	if err := preValidateSchema(doc); err != nil {
		return nil, errors.WithStack(err)
	}

	c := NewCompiler(disallowRefs)
	if err := c.AddResource(schemaURL, bytes.NewReader(data)); err != nil {
		return nil, errors.WithStack(err)
	}
	return c, nil

View on GitHub (pinned to b86338da04)