PTah
80320ae698
Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS enforce on startup, SSH host-key verification and sudo via stdin, optional WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping, and HMAC API key hashing with legacy SHA-256 fallback.
24 lines
624 B
Python
24 lines
624 B
Python
"""Ingest body size limit middleware."""
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.testclient import TestClient
|
|
|
|
from app.middleware.ingest_body_limit import IngestBodySizeLimitMiddleware
|
|
|
|
|
|
def test_ingest_body_size_limit_rejects_large_content_length():
|
|
app = FastAPI()
|
|
app.add_middleware(IngestBodySizeLimitMiddleware, max_bytes=128)
|
|
|
|
@app.post("/api/v1/events")
|
|
def ingest():
|
|
return {"ok": True}
|
|
|
|
client = TestClient(app)
|
|
response = client.post(
|
|
"/api/v1/events",
|
|
content=b"x" * 10,
|
|
headers={"content-length": "256"},
|
|
)
|
|
assert response.status_code == 413
|