Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Oathkeeper docs claim a max_request_body_size config on the remote authorizer that doesn't exist in the schema or source

Abierto Apto para principiantes
  • ¿Algo no está bien?
#2,706 1 comentario 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
78/100
Tipo de issue
Documentación
Claridad
Bastante claro
Estado de actividad
Activo
Área
documentation

Línea de trabajo

Abre la página de documentación de Oathkeeper sobre authz y localiza la sección del autorizador remoto que contiene el claim max_request_body_size. Verifícalo con spec/config.schema.json, pipeline/authz/remote.go y pipeline/authz/utils.go; se considera terminado cuando se elimine el claim inexacto o se marque claramente la funcionalidad como no disponible.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
Preflight checklist
Ory Network Project

No response

Describe the bug

The Oathkeeper documentation page for the authz pipeline
(https://www.ory.com/docs/oathkeeper/pipeline/authz) describes a
max_request_body_size setting on the remote authorizer that does
not exist in the config schema or the actual implementation.

The page states:

The maximum inbound request body size that Ory Oathkeeper buffers
so it can replay the body to the upstream service. The default is
"10MiB".

Ory Oathkeeper rejects requests that exceed the limit with HTTP 413
before calling the remote authorizer.

This appears to be incorrect / describes a feature that was never
implemented:

  • spec/config.schema.json defines configAuthorizersRemote and
    configAuthorizersRemoteJSON with only remote, headers,
    forward_response_headers_to_upstream, retry (and payload for
    the JSON variant) — no max_request_body_size property on either.
  • pipeline/authz/remote.go and pipeline/authz/utils.go
    (pipeRequestBody) pipe the request body via an unbounded
    io.TeeReader into a bytes.Buffer — no size check, no cap, no
    HTTP 413 anywhere in either file.
  • A GitHub commit search for MaxRequestBodySize across the full
    repo history returns zero results — this identifier has never
    existed in the codebase.

Suggested fix: remove the claim from the docs page, or if this was a
planned-but-unshipped feature, mark it clearly as not yet available.

Reproducing the bug

Not applicable in the docker/curl sense — this is a documentation
inaccuracy, not a runtime bug. To verify:

  1. Visit https://www.ory.com/docs/oathkeeper/pipeline/authz and read
    the remote authorizer section — note the max_request_body_size
    / 10MiB / HTTP 413 claim.
  2. Check spec/config.schema.json on the master branch — search for
    max_request_body_size: no match under either the remote or
    remote_json authorizer definitions.
  3. Check pipeline/authz/remote.go and pipeline/authz/utils.go on the
    master branch — no body size limit logic anywhere in either
    file; pipeRequestBody() buffers the body unbounded.
  4. Search commit history for MaxRequestBodySize — zero results.
Relevant log output
N/A — this is a documentation inaccuracy, not a runtime error. No
logs to provide.
Relevant configuration
N/A — no runtime config triggers this. For reference, the actual
(correct) schema for the affected section, from
spec/config.schema.json on the master branch:

authorizers:
  remote:
    config:
      remote: <url>
      headers: {}
      forward_response_headers_to_upstream: []
      retry: {}

No max_request_body_size property exists here or under remote_json.
Version

master

On which operating system are you observing this issue?

None

In which environment are you deploying?

None

Additional Context

No response

Lenguaje dominante
TypeScript
Estrellas
161
Forks
1.9k
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de ory/docs

Todos los issues de ory/docs

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.