dnsbty

dnsbty

I’m currently using Req in an application, and as I’m thinking about potential security concerns, I have two scenarios in mind where I would like to check the response headers before getting the full body.

For webhooks, I really only care about the headers. If, for example, someone were to sign up and respond to my webhook request with a large payload, I would rather not load the full response payload into memory. Since all I really care about is the HTTP response status code, is it possible to get only that? I was looking at doing something like this, but wondered if there’s a better way:

resp = Req.get!(endpoint.url, into: :self)
Req.cancel_async_response(resp)

For downloading files from URLs sent to my API, I would like to check that the file size and mime type are within our expected parameters before downloading the body. Is this the best way to do that?

resp = Req.get!(file.url, into: :self)
mime_type = Req.Response.get_header(resp, "content-type")
content_length = Req.Response.get_header(resp, "content-length")
  
cond do
  mime_type not in @supported_mime_types ->
    Req.cancel_async_response(resp)
    {:error, :unsupported_file_type}
  
  content_length > @max_file_size ->
    Req.cancel_async_response(resp)
    {:error, :file_too_big}
  
  true ->
    {:ok, resp.body}
end

Thanks!

Showing Posts 1 to 5

mayel

mayel

wojtekmach

wojtekmach

Hex Core Team

I think making a HEAD request is the most straightforward. Other than that, either into: :self + cancel (though you’d probably have received some messages by then) or into: fun:

iex> Req.get!("https://httpbin.org/status/201", into: fn {req, resp}, acc -> {:halt, {req, resp}} end)
%Req.Response{
  status: 201,
  headers: %{
    "access-control-allow-credentials" => ["true"],
    "access-control-allow-origin" => ["*"],
    "connection" => ["keep-alive"],
    "content-length" => ["0"],
    "content-type" => ["text/html; charset=utf-8"],
    "date" => ["Fri, 08 Nov 2024 19:55:52 GMT"],
    "server" => ["gunicorn/19.9.0"]
  },
  body: "",
  trailers: %{},
  private: %{}
}
wojtekmach

wojtekmach

Hex Core Team

Oh, for checking content-type, file size, etc, I’d use into: fun too. It’s more efficient than into: :self in that it uses the socket in passive mode so you can easily halt before reading any body part.

dnsbty

dnsbty OP

I think this makes a lot of sense for the download scenario if I make the HEAD request and then perform the GET if everything matches. But for the webhook use case, I’m POSTing data to the endpoint, and unless I don’t understand the spec properly, you can’t do that with a HEAD request, right?

dnsbty

dnsbty OP

Perfect. Thank you!

— All posts loaded —

Where Next? Top

Trending in Questions Top

RSP87
I’m working on a project that simulates the bumbl example in the programming phoenix book. It acts almost like an email client. We have a...
New
nseaSeb
Hello, I know there is an approach for handling lists that allows for optimized traversal, but I can’t recall the specific method (somet...
New
kpanic
Hi everyone, I am toying with the idea of building a “match maker” for giving personal help to people that wants to start coding. I sta...
New
brecabral
Documentation While reading the Scoped Routes section, I noticed that the documentation currently refers to a problem without explainin...
New
velrest
So my question is quite simple and i have found no conclusive answer on forum, google or AI. Should we use :erlang.float for Integer to ...
New
asweet-confluent
I recently noticed that Elixir’s Logger defaults its primary log level to :debug when no :logger, :level application configuration is pre...
New
apz
I’m new to elixir and just tried to install the elixirLS extension for VScode(ium) and it is throwing some errors that I would like help ...
New

Other Trending Topics Top

GenericJam
Edit: 2026 May 15 - This post is archived. Mob is alive!! Main docs: mob v0.7.11 — Documentation A bit of explanation for the slightly c...
New
JesseHerrick
Hey, I’m Jesse and I’m the main contributor behind Dexter, a full-featured, lightning-fast Elixir LSP optimized for large codebases. It s...
New
mudasobwa
I am happy to introduce the very α version of the new programming language compiled to BEAM. Welcome Cure. It has literally three kille...
New
marciok
Hi there! We created Gust: A task orchestrator inspired by Airflow. For those who have never heard about Aiflow, it’s a Python-based wor...
New
mhanberg
Hi everyone! The first release candidate for the Expert language server project is now available! We’ve published a press release detai...
New
jimsynz
Beam Bots (or just BB for short) is a framework for building fault-tolerant robotics applications in Elixir using familiar OTP patterns. ...
New

We're in Beta

About us Mission Statement

Options

Thread Display Mode




Thread Preview

Skip Thread Previews