v26.4.0
v26.4.0
Size limits for remote files and upstream responses
Ory now rejects files loaded from a URL (http://, https://, file://, or base64://) and upstream responses that exceed a
size limit, instead of reading them in full. If a fetch exceeds its limit, the operation fails. Ory Kratos also logs a warning
that names the source and the limit.
| Source | Limit |
|---|---|
| Ory Kratos: Jsonnet templates and claims mappers loaded from a URL (webhooks, courier, OpenID Connect, SCIM, session tokenizer) | 1 MiB |
| Ory Kratos: token and user info responses from social sign-in providers | 1 MiB |
| Ory Talos: JSON Web Key Sets loaded from a URL | 1 MiB |
| Any other file loaded from a URL, such as courier templates or Ory Permission Language files in Ory Keto | 5 MiB |
If you expect to use a file larger than these limits, reduce its size before upgrading.