Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Oathkeeper docs claim a max_request_body_size config on the remote authorizer that doesn't exist in the schema or source

未关闭 适合新手
  • 哪里不对？
#2,706 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
78/100
Issue 类型
文档
描述清晰度
基本清楚
活跃度
活跃
领域
documentation

调研方向

打开 Oathkeeper 的 authz 文档页面，找到包含 max_request_body_size claim 的远程授权器部分。根据 spec/config.schema.json、pipeline/authz/remote.go 和 pipeline/authz/utils.go 对其进行验证；完成的标准是移除不准确的 claim，或明确标记该功能不可用。

由索引模型根据 Issue 内容生成。

描述

bug
Preflight checklist
Ory Network Project

No response

Describe the bug

The Oathkeeper documentation page for the authz pipeline
(https://www.ory.com/docs/oathkeeper/pipeline/authz) describes a
max_request_body_size setting on the remote authorizer that does
not exist in the config schema or the actual implementation.

The page states:

The maximum inbound request body size that Ory Oathkeeper buffers
so it can replay the body to the upstream service. The default is
"10MiB".

Ory Oathkeeper rejects requests that exceed the limit with HTTP 413
before calling the remote authorizer.

This appears to be incorrect / describes a feature that was never
implemented:

  • spec/config.schema.json defines configAuthorizersRemote and
    configAuthorizersRemoteJSON with only remote, headers,
    forward_response_headers_to_upstream, retry (and payload for
    the JSON variant) — no max_request_body_size property on either.
  • pipeline/authz/remote.go and pipeline/authz/utils.go
    (pipeRequestBody) pipe the request body via an unbounded
    io.TeeReader into a bytes.Buffer — no size check, no cap, no
    HTTP 413 anywhere in either file.
  • A GitHub commit search for MaxRequestBodySize across the full
    repo history returns zero results — this identifier has never
    existed in the codebase.

Suggested fix: remove the claim from the docs page, or if this was a
planned-but-unshipped feature, mark it clearly as not yet available.

Reproducing the bug

Not applicable in the docker/curl sense — this is a documentation
inaccuracy, not a runtime bug. To verify:

  1. Visit https://www.ory.com/docs/oathkeeper/pipeline/authz and read
    the remote authorizer section — note the max_request_body_size
    / 10MiB / HTTP 413 claim.
  2. Check spec/config.schema.json on the master branch — search for
    max_request_body_size: no match under either the remote or
    remote_json authorizer definitions.
  3. Check pipeline/authz/remote.go and pipeline/authz/utils.go on the
    master branch — no body size limit logic anywhere in either
    file; pipeRequestBody() buffers the body unbounded.
  4. Search commit history for MaxRequestBodySize — zero results.
Relevant log output
N/A — this is a documentation inaccuracy, not a runtime error. No
logs to provide.
Relevant configuration
N/A — no runtime config triggers this. For reference, the actual
(correct) schema for the affected section, from
spec/config.schema.json on the master branch:

authorizers:
  remote:
    config:
      remote: <url>
      headers: {}
      forward_response_headers_to_upstream: []
      retry: {}

No max_request_body_size property exists here or under remote_json.
Version

master

On which operating system are you observing this issue?

None

In which environment are you deploying?

None

Additional Context

No response

主要语言
TypeScript
星标
161
派生
1.9k
30 天内没有已合并 PR

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

ory/docs 的其他 Issue

查看 ory/docs 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。