Plug.Parsers has a :length option, which is set to 8MB by default and prevents reading request bodies larger than the given length.
Does LiveView have an equivalent setting for message payloads?
LiveView itself can’t. It just builds on top of channels and channels can run on many different transports. Websockets just happen to be one of those. You can look at the options for the default channel transports at the following url. There seems to be a :max_frame_size option.
I see, interesting find! And the default is… :infinity 
IMO this should be changed to harden the out-of-the-box Phoenix setup.
Do I understand correctly that Phoenix.Transports.LongPoll is covered by Plug.Parsers in that regard since it’s a Plug itself?
No. All things handled by the socket macro never even reach the plug pipeline you setup in the endpoint. They’re completely separate.
Looks like there is a binary size limit for certain payload types. It is hardcoded to 10MB.
To summarize:
- LiveView uses multiple transports like WebSockets and HTTP Long Polling via Phoenix.Channel behaviour
- Every transport protocol needs to individually mitigate overly large payloads
- WebSocket:
:max_frame_sizeoption is configurable, passed to WebSockAdapter — WebSockAdapter v0.5.9, then handled by Bandit — Bandit v1.10.3 or Nine Nines: cowboy_websocket(3) - Long Polling: request body limit for JSON only applies to binaries (hardcoded to 10MB) phoenix/lib/phoenix/transports/long_poll.ex at main · phoenixframework/phoenix · GitHub
socket "/ws/admin", MyApp.AdminUserSocket, # or Phoenix.LiveView.Socket
longpoll: true,
websocket: [max_frame_size: 10_000_000] # 10 MB
1 Like
