zorn
I have a simple User-like Ecto schema backed up by a PostgreSQL database. There is a :bio field that is of type :text. I have other fields for things like :first_name of type :string and I’ve started adding validations like
validate_length(:first_name, max: 255)
to make sure any changesets are more honest about expectations. I’m considering something similar for the :bio field but wanted to ask for guidance.
Any thoughts? Is it a good idea to put some cap on the content length to help with abuse, security or performance concerns?
Where Next?
Trending in Questions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Build Elixir applications with speed and confidence.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #ai
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #elixirconf-eu
- #metaprogramming
- #hex
Our Sponsors
Build Elixir applications with speed and confidence.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Bringing learning, work and compliance together since 1987.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 2- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
hauleth
Just no, use
:texteverywhere.harmon25
Probably not if it was just a performance concern, as it likely won’t actually be…
However,
If your threat model includes malicious actors trying to run you out of disk via that ‘bio’ field, a length check in the changeset would be reasonable. It’s important to communicate that up front when a user starts filling it in so they don’t get cut off early.
The security of the field/contents is also more of a frontend concern, does the bio contain HTML or some encoding that may introduce XSS or other code exec vulnerabilities? If so, some form of sanitization is required for sure…
Depending on the front end tech in place, and if it is sanitizing strings before writing to DOM (eex,react) by default AND the field is just text, could rely on the rendering engine to sanitize the bio field of potentially malicious HTML/JS…
A layered defense is always the best approach though. And performing some sort of threat model to understand whom you are defending against is important when making these kinds of decisions…
Good luck!