Skip to main content

v26.3.9

v26.3.9​

Bound request-body buffering in the Oathkeeper remote authorizer​

The remote authorizer buffers the inbound request body so it can be replayed to the upstream after the authorization call. That buffer is now bounded through the new max_request_body_size option.

The value is a human-readable byte size such as "10MiB" or "1GiB". Sizes are powers of 1024; the legacy suffixes KB, MB, GB and so on are accepted and mean the same. Set the option to "unlimited" or "0" to disable the limit. Requests larger than the limit are rejected with HTTP 413 Request Entity Too Large before any part of the body reaches the remote authorizer.

Only the remote authorizer is affected. The remote_json authorizer does not read the inbound body and is unchanged.

Breaking changes​

Routes using the remote authorizer now default to a 10MiB limit. Requests with bodies larger than that are rejected with HTTP 413 unless you raise max_request_body_size or set it to "unlimited" or "0".