Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Support formData fields ordering and reading them as they come in #1683

Open
KristijanZic opened this issue Feb 2, 2025 · 2 comments
Labels
feature A new feature or request

Comments

@KristijanZic
Copy link

KristijanZic commented Feb 2, 2025

Description

There is a use case with multipart form data uploads where the uploading file is bundled together with the auth in the same form.
Now that creates an issue in Dart Frog where we can't authenticate the signature/token before the entire form data is cached on the server.
This means that we can't reject the request before caching the entire file ergo, somebody can send a couple of 1GB requests and overload the server.

It would be great if we could have something like reading the fields by order, get the auth ones first, verify them and then accept the rest or reject the request.

One would think that it would be the best to put the auth in the header but for some reason AWS S3 has it in the form data fields with the file. I don't know if there are some security implications etc. But anyone that wants to make an S3 compatible endpoint this will be a deal breaker issue.

Further context

@KristijanZic KristijanZic added the feature A new feature or request label Feb 2, 2025
@alestiago
Copy link
Contributor

alestiago commented Feb 9, 2025

Hi @KristijanZic thanks for opening an issue!

Do you have any proposal in mind? Is there any other framework out there that had a solution that you liked for solving this use case?

I'm not sure if there exists a way to solve this use case where the authentication is within the body (cc: @wolfenrain ).

@alestiago alestiago added the waiting for response Waiting for follow up label Feb 9, 2025
@wolfenrain
Copy link
Member

We talked about this on the bloc discord, an idea to look into is using sync generators and iterables to only parse as much as the user requests instead of everything in one go

Theoretically it is possible but we need to verify if this is feasible and user-friendly

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature A new feature or request
Projects
Status: Needs Triage
Development

No branches or pull requests

3 participants