What part of that do you interpret as trusting the client?

CodeWriter23 · 2024-08-13T20:59:35 1723582775

> Paul points out that alternative paths such as WebSockets might bypass limits that are in place for regular HTTP requests <

zbentley · 2024-08-13T21:15:38 1723583738

I'm not sure I interpret that as trusting the client; rather, it seems like the implication is that HTTP limits will be handled correctly by webserver harnesses, whereas WebSockets may not get any such behavior "for free" from the server framework.

echoangle · 2024-08-14T07:49:41 1723621781

He’s saying that some Webservers allow you to limit request size, but the limits you set might only apply to HTTP(S) and can be circumvented when using another protocol. That’s a server side problem.

Sohcahtoa82 · 2024-08-14T16:38:19 1723653499

Is English not your first language? If it is, I am utterly baffled as how you think that's an endorsement trusting the client, rather than merely a description.