2026-10-21 20:36 UTC
So one option in #Vinyl_Cache is to check if you have any such requests:
vinyllog -dCq 'ReqHeader:Content-Type ~ multipart/form'
vinyllog -Cq 'ReqHeader:Content-Type ~ multipart/form'
The first command scans the in-memory log, the second runs until interrupted on live data.
If you do not see multipart/form-data requests, you can simply refuse them in VCL.
#php2shell
Replies (1)
-
@slink@fosstodon.org 2026-10-21 20:54
Another very simple option in #Vinyl_Cache is to limit the size of request bodies using std.cache_req_body(). This also has the added benefit that chunked transfer encoding is tuned into a request with a content-length, such that php can check it upfront against the maximum body size. In the example, the maximum size should be adjusted accordingly. #php2shell https://vinyl-cache.org/docs/trunk/reference/vmod_std.html#std-cache-req-body