id: http-block-large-body
name: Block large request bodies
protocol: http
description: Rejects oversized HTTP request bodies before they hit the service.
category: http
family: web-hardening
tags:
- length-limit
- body-size
- web
- block
action: block
summary: Rejects oversized HTTP request bodies before they hit the service.
behavior: Checks the buffered request body length, returns 413 Payload Too Large,
  and logs the observed size.
source_url: https://docs.mitmproxy.org/stable/addons/examples/
code: |
  import logging

  from mitmproxy import http

  MAX_BODY_BYTES = 8192


  def request(flow: http.HTTPFlow) -> None:
      size = len(flow.request.raw_content or b"")
      if size > MAX_BODY_BYTES:
          logging.warning(
              "[http-block-large-body] blocked %s bytes on %s",
              size,
              flow.request.pretty_url,
          )
          flow.response = http.Response.make(
              413,
              b"",
              {"content-type": "text/plain"},
          )