This lesson's interactive features are locked, please to keep using them

Resource Limits

Rate limiting controls how often a client can call your API. Resource limits control how much work a single request can demand. For example:

Request body size – limit the size of incoming JSON or file uploads
Processing time – set a maximum time for database queries or third-party API calls
Result size – cap the number of items returned in a list or the size of a generated report

I used to do a lot of work with the Facebook and Instagram APIs, and their limits were based on request processing time. One complex query can be 100x more expensive than ten simple ones!

Body and Upload Limits

HTTP servers should enforce a maximum request body size. Go's http.MaxBytesReader stops a handler from reading beyond an explicit limit:

request.Body = http.MaxBytesReader(responseWriter, request.Body, 32*1024)

File uploads need their own limits. A multipart request includes file bytes and encoding overhead, so limit both the request body and the bytes read from each uploaded file. Also reject extra files instead of quietly processing the first one.

Go's io.LimitReader is useful for enforcing the per-file boundary after parsing the multipart form.

Keep in mind that a tiny compressed file can still expand into gigabytes, and a small input to an ~~evil~~ regex can burn through your server's CPU. Limit the resource that can actually be exhausted.

Assignment

Bearly Secure has the limit settings and max-aware APIs, but several request paths don't enforce them yet.

Complete the app's per-request resource limits.

In internal/httpserver/auth.go, update the shared parseForm middleware to cap each parsed form body at maxBodyBytes. Preserve the existing 413 Content Too Large response for oversized forms.
In internal/httpserver/app.go, pass options.MaxUploadBytes to both tax-document upload handlers:
- Individual documents handled by uploads.Handler.
- ZIP archives handled by support.Handler.
In internal/uploads/handler.go and internal/support/handler.go, require exactly one file per upload. Return 413 Content Too Large without storing anything when the file exceeds the configured maximum.
In internal/httpserver/app.go, pass options.MaxPublicProductResults to both the storefront and API handlers so /, /search, and /api/products return at most 50 products.
Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.