This lesson's interactive features are locked, please to keep using them

Resource Limits

Rate limiting controls how often a client can call your API. Resource limits control how much work a single request can demand. For example:

Request body size – limit the size of incoming JSON or file uploads
Processing time – set a maximum time for database queries or third-party API calls
Result size – cap the number of items returned in a list or the size of a generated report

I used to do a lot of work with the Facebook and Instagram APIs, and their limits were based on request processing time. One complex query can be 100x more expensive than ten simple ones!

Body and Upload Limits

HTTP servers should enforce a maximum request body size. Express's JSON parser defaults to 100 KB, but you should choose an explicit limit for your app:

app.use(express.json({ limit: "100kb" }));

File uploads need their own limits. With multer, you can limit both file size and count:

import multer from "multer";

const upload = multer({
  limits: {
    fileSize: 5 * 1024 * 1024, // 5 MB
    files: 1,
  },
});

Keep in mind that a tiny compressed file can still expand into gigabytes, and a small input to an ~~evil~~ regex can burn through your server's CPU. Limit the resource that can actually be exhausted.

Assignment

Bearly Secure accepts request bodies and file uploads of any size, and its public product queries can return an unbounded number of rows.

Complete the app's per-request resource limits.

In src/app.ts, where createApp registers the express.urlencoded and express.json parsers, limit both body sizes to the maxRequestBodyBytes dependency setting.
In src/uploads/middleware.ts, give createUploadMiddleware a maxBytes parameter and use multer's limits to cap each upload at that size and to one file per request.
Pass the maxUploadBytes dependency setting where that middleware is created:
- uploadTaxDocument at the top of createAccountRouter in src/routes/account.ts
- uploadTaxArchive at the top of createArchiveRouter in src/routes/archive.ts
Limit public product queries to maxPublicProductResults:
- In src/routes/api.ts, the GET /api/products handler should use listPublicProducts.
- In src/routes/storefront.ts, the GET / handler should use listPublicProducts and the GET /search handler should use searchPublicProducts.
Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.