One bounded HTTP client for every server-side fetch; uploads refused while streaming

Every outbound fetch - Gitea content at boot and on reload, the raw
asset proxy, the repo-info endpoint, the content-declared url resource
- built its own reqwest client with no timeout and read whole bodies
with .text(). `crate::http` is now the one client (5 s connect, 20 s
per request, 5 redirects) with capped body readers: 2 MB for a url
resource, 8 MB for a Gitea reply, 32 MB for a proxied asset; one byte
over is an error, never a truncated document.

The upload handler read a whole field into memory before comparing it
to the 20 MB cap, and axum's 2 MB default body limit had made that cap
unreachable anyway. It now reads chunk by chunk and refuses the moment
the cap is crossed; the /upload route raises the body limit to match.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

This commit is contained in:

Bendik Aagaard Lynghaug

2026-09-22 16:51:15 +02:00

co-authored by

Claude Fable 5.1

parent d7f60eaa31

commit c91bf59946

5 changed files with 99 additions and 18 deletions

									
										src/lib.rs
									
		+3
		
												View File
												
				@@ -19,6 +19,9 @@ pub mod needs;

				#[cfg(feature = "ssr")]

				pub mod local;

				#[cfg(feature = "ssr")]

				pub mod http;

				#[cfg(feature = "ssr")]

				pub mod server;