dnsbty

dnsbty

I’m currently using Req in an application, and as I’m thinking about potential security concerns, I have two scenarios in mind where I would like to check the response headers before getting the full body.

For webhooks, I really only care about the headers. If, for example, someone were to sign up and respond to my webhook request with a large payload, I would rather not load the full response payload into memory. Since all I really care about is the HTTP response status code, is it possible to get only that? I was looking at doing something like this, but wondered if there’s a better way:

resp = Req.get!(endpoint.url, into: :self)
Req.cancel_async_response(resp)

For downloading files from URLs sent to my API, I would like to check that the file size and mime type are within our expected parameters before downloading the body. Is this the best way to do that?

resp = Req.get!(file.url, into: :self)
mime_type = Req.Response.get_header(resp, "content-type")
content_length = Req.Response.get_header(resp, "content-length")
  
cond do
  mime_type not in @supported_mime_types ->
    Req.cancel_async_response(resp)
    {:error, :unsupported_file_type}
  
  content_length > @max_file_size ->
    Req.cancel_async_response(resp)
    {:error, :file_too_big}
  
  true ->
    {:ok, resp.body}
end

Thanks!

Showing Posts 5 to 1

dnsbty

dnsbty OP

Perfect. Thank you!

dnsbty

dnsbty OP

I think this makes a lot of sense for the download scenario if I make the HEAD request and then perform the GET if everything matches. But for the webhook use case, I’m POSTing data to the endpoint, and unless I don’t understand the spec properly, you can’t do that with a HEAD request, right?

wojtekmach

wojtekmach

Hex Core Team

Oh, for checking content-type, file size, etc, I’d use into: fun too. It’s more efficient than into: :self in that it uses the socket in passive mode so you can easily halt before reading any body part.

wojtekmach

wojtekmach

Hex Core Team

I think making a HEAD request is the most straightforward. Other than that, either into: :self + cancel (though you’d probably have received some messages by then) or into: fun:

iex> Req.get!("https://httpbin.org/status/201", into: fn {req, resp}, acc -> {:halt, {req, resp}} end)
%Req.Response{
  status: 201,
  headers: %{
    "access-control-allow-credentials" => ["true"],
    "access-control-allow-origin" => ["*"],
    "connection" => ["keep-alive"],
    "content-length" => ["0"],
    "content-type" => ["text/html; charset=utf-8"],
    "date" => ["Fri, 08 Nov 2024 19:55:52 GMT"],
    "server" => ["gunicorn/19.9.0"]
  },
  body: "",
  trailers: %{},
  private: %{}
}
mayel

mayel

— All posts loaded —

Where Next? Top

Trending in Questions Top

RSP87
I’m working on a project that simulates the bumbl example in the programming phoenix book. It acts almost like an email client. We have a...
New
nseaSeb
Hello, I know there is an approach for handling lists that allows for optimized traversal, but I can’t recall the specific method (somet...
New
kpanic
Hi everyone, I am toying with the idea of building a “match maker” for giving personal help to people that wants to start coding. I sta...
New
brecabral
Documentation While reading the Scoped Routes section, I noticed that the documentation currently refers to a problem without explainin...
New
velrest
So my question is quite simple and i have found no conclusive answer on forum, google or AI. Should we use :erlang.float for Integer to ...
New
asweet-confluent
I recently noticed that Elixir’s Logger defaults its primary log level to :debug when no :logger, :level application configuration is pre...
New
samoloth
Hi, I’ve just set up an application with ash_authentication. There is only magic link strategy for now, so there is no confirmation add o...
New

Other Trending Topics Top

JesseHerrick
Hey, I’m Jesse and I’m the main contributor behind Dexter, a full-featured, lightning-fast Elixir LSP optimized for large codebases. It s...
New
mudasobwa
I am happy to introduce the very α version of the new programming language compiled to BEAM. Welcome Cure. It has literally three kille...
New
marciok
Hi there! We created Gust: A task orchestrator inspired by Airflow. For those who have never heard about Aiflow, it’s a Python-based wor...
New
mhanberg
Hi everyone! The first release candidate for the Expert language server project is now available! We’ve published a press release detai...
New
jimsynz
Beam Bots (or just BB for short) is a framework for building fault-tolerant robotics applications in Elixir using familiar OTP patterns. ...
New
Dmk
Xamal is a deployment tool for Elixir apps that deploys native releases to bare metal servers over SSH. It’s a port of GitHub - basecamp/...
New

Latest on Elixir Forum

We're in Beta

About us Mission Statement

Options

Thread Display Mode




Thread Preview

Skip Thread Previews