What
express.json() is used with default limits. The default 100KB limit should be explicitly configured and documented.
Why
An explicit limit prevents large-payload denial-of-service attacks and makes the configuration visible.
Scope
- Set explicit
limit option on express.json()
- Make configurable via
BODY_SIZE_LIMIT env var
- Document the default and how to change it
Acceptance Criteria
Technical Context
src/index.ts:16 — app.use(express.json())- Express 5
json() accepts limit option
- Default:
100kb
What
express.json()is used with default limits. The default 100KB limit should be explicitly configured and documented.Why
An explicit limit prevents large-payload denial-of-service attacks and makes the configuration visible.
Scope
limitoption onexpress.json()BODY_SIZE_LIMITenv varAcceptance Criteria
express.json()configured with explicit limitBODY_SIZE_LIMITenv var supported (default:100kb)Technical Context
src/index.ts:16—app.use(express.json())json()acceptslimitoption100kb