Node Incoming Body Limits and Abort State

Working case

Permit intake accepts 37 KiB of JSON because it carries inspection notes, but a client sends 47 MiB in small chunks without Content-Length. A handler that collects all chunks first can exhaust memory across concurrent requests. Another client closes the socket halfway through an approval command. Logging the unfinished bytes as a complete rejected command creates misleading audit history. The handler must stop reading at the byte budget, avoid writing a response after the socket disappears, and never call the approval service for an incomplete request. A well-formed 38 KiB body receives a deliberate size response.

Implementation boundary

async function readBoundedJson(request, maximumBytes = 37 * 1024) {
  const chunks = [];
  let receivedBytes = 0;
  for await (const chunk of request) {
    receivedBytes += chunk.length;
    if (receivedBytes > maximumBytes) throw new Error("body_too_large");
    chunks.push(chunk);
  }
  if (!request.complete) throw new Error("body_incomplete");
  return JSON.parse(Buffer.concat(chunks, receivedBytes).toString("utf8"));
}

Configure parser and proxy limits together, then enforce a route-local limit on actual chunks. A counted read should reject before concatenation when the next chunk exceeds the budget; it should also bound read time, because a tiny body can arrive indefinitely. Keep the raw buffer local to the request and discard it on error. Validate the content type, decode text once, parse JSON once, and convert it to an allowlisted command. A truncated request is a transport failure; malformed JSON is a client input failure. Return a bounded error object without echoing the supplied payload. Treat any later write as conditional on the response still being writable.

Cost and boundaries

For a body of B admitted bytes, the read and decode cost is O(B), and accumulating chunks consumes O(B) memory per concurrent request. JSON parsing can add another object graph of roughly input-proportional size, so multiply the budget by expected concurrency rather than comparing it only with host RAM. Early rejection limits worst-case bytes retained but cannot undo bytes already received by the proxy. Streaming formats can lower retained memory, yet they complicate validation and commit ordering. Record accepted sizes, oversize counts, slow-body deadlines, aborted reads, and parse failures separately; one combined bad-request metric hides attacks and ordinary client errors.

Failure trace

Send an admitted JSON command in one chunk and in uneven chunks; they must produce the same typed command. Send a body exactly at the byte cap and one byte beyond it. Omit Content-Length, lie about its value, split a multibyte character across chunks, and close before the final brace. Keep a connection open while sending one byte at a time to exercise the read deadline. Repeat these cases with twenty simultaneous clients while measuring retained heap. In every rejected or aborted case, the permit table and audit log must remain unchanged. Confirm the server does not attempt a second response after a socket error.

Verification

A partial or oversized body never reaches the approval service.
Exactly-at-limit and limit-plus-one inputs have different outcomes.
Concurrent rejected requests remain within the heap budget.

Practice drill

Implement a permit-admission endpoint with a strict body budget of 37 KiB, a short read deadline, and a typed command containing permitId, inspectionRevision, and notes. Capture a stable request ID before parsing, but do not include raw notes in logs. Feed it malformed JSON, an oversized chunked body, a partial socket close, and a valid command. Assert the downstream approval function is called once only for the valid body. Run the same cases behind a reverse proxy with a different global limit and document which layer rejects first. Add a test for ambiguous content types and for an empty body.

Decision note

Transport admission and domain validation are separate gates; neither may commit a partial command.

Common Mistakes

Trusting Content-Length instead of counting delivered bytes.
Parsing an incomplete body as a complete command.
Logging raw rejected JSON containing private notes.

Apply and check

Build Project: Native Node Permit Gateway and review Web Development: Native Node Runtime Contracts.