Gap Claim
The control-plane request-size limit is applied only after framework buffering, so a chunked request can consume unbounded memory before rejection. API-404 cannot claim bounded authenticated ingress.
Existing Surface Audit
Reviewed FastAPI routes, request parsing, body-limit configuration, middleware hooks, tests, and the current #1086 implementation. Using Starlette private request body state is not a stable enforcement boundary.
Lineage and Precedent
Extends API-404 request admission at the ASGI transport boundary without changing SDL or operation semantics.
Literature and Practice
Follow ASGI receive-stream semantics and HTTP 413 behavior: count delivered body bytes incrementally and stop admission before application buffering.
Alternatives
- Check Content-Length only: rejected because it is optional and untrusted. 2. Inspect a fully buffered Request body: rejected because allocation already occurred. 3. Wrap the ASGI receive channel and enforce cumulative bytes: chosen.
Chosen Architecture
A public ASGI middleware/receive wrapper counts cumulative request bytes, rejects over-limit bodies with a stable 413 response, and leaves normal streaming behavior intact. No private Starlette attributes or NOSONAR suppression.
Documentation Defense
Document which routes are bounded, configuration semantics, counting boundary, 413 response, and proxy-layer expectations.
Verification Plan
Test absent/false Content-Length, chunked under/at/over limit, many small chunks, disconnects, zero-length bodies, and that the endpoint is never invoked after overflow.
Parent: #8
Gap Claim
The control-plane request-size limit is applied only after framework buffering, so a chunked request can consume unbounded memory before rejection. API-404 cannot claim bounded authenticated ingress.
Existing Surface Audit
Reviewed FastAPI routes, request parsing, body-limit configuration, middleware hooks, tests, and the current #1086 implementation. Using Starlette private request body state is not a stable enforcement boundary.
Lineage and Precedent
Extends API-404 request admission at the ASGI transport boundary without changing SDL or operation semantics.
Literature and Practice
Follow ASGI receive-stream semantics and HTTP 413 behavior: count delivered body bytes incrementally and stop admission before application buffering.
Alternatives
Chosen Architecture
A public ASGI middleware/receive wrapper counts cumulative request bytes, rejects over-limit bodies with a stable 413 response, and leaves normal streaming behavior intact. No private Starlette attributes or NOSONAR suppression.
Documentation Defense
Document which routes are bounded, configuration semantics, counting boundary, 413 response, and proxy-layer expectations.
Verification Plan
Test absent/false Content-Length, chunked under/at/over limit, many small chunks, disconnects, zero-length bodies, and that the endpoint is never invoked after overflow.
Parent: #8