Mercurial > prosody-hg

changeset 14124:a4327478678f 13.0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_bosh: Apply different stanza size limit before authentication This is a bit tricky since each request creates a new stream and we have to start parsing the stream before we know if it belongs to an already authenticated session.
author Kim Alvefur <zash@zash.se>
date Fri, 17 Apr 2026 12:07:12 +0200
parents 166ac7d65cb6
children 863da67a4b51
files plugins/mod_bosh.lua
diffstat 1 files changed, 10 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/plugins/mod_bosh.lua	Tue Apr 07 20:44:41 2026 +0200
+++ b/plugins/mod_bosh.lua	Fri Apr 17 12:07:12 2026 +0200
@@ -45,7 +45,7 @@
 
 local consider_bosh_secure = module:get_option_boolean("consider_bosh_secure");
 local cross_domain = module:get_option("cross_domain_bosh");
-local stanza_size_limit = module:get_option_integer("c2s_stanza_size_limit", 1024*256, 10000);
+local unauthed_stanza_size_limit = module:get_option_integer("c2s_stanza_size_limit", 10000, 1000);
 
 if cross_domain ~= nil then
 	module:log("info", "The 'cross_domain_bosh' option has been deprecated");
@@ -123,8 +123,9 @@
 	local body = request.body;
 
 	local context = { request = request, response = response, notopen = true };
-	local stream = new_xmpp_stream(context, stream_callbacks, stanza_size_limit);
+	local stream = new_xmpp_stream(context, stream_callbacks, unauthed_stanza_size_limit);
 	response.context = context;
+	context.stream = stream;
 
 	local headers = response.headers;
 	headers.content_type = "text/xml; charset=utf-8";
@@ -333,6 +334,7 @@
 			close = bosh_close_stream, dispatch_stanza = core_process_stanza, notopen = true,
 			log = logger.init("bosh"..sid),	secure = consider_bosh_secure or request.secure,
 			ip = request.ip;
+			stanza_size_limit = unauthed_stanza_size_limit;
 		};
 		sessions[sid] = session;
 
@@ -406,6 +408,11 @@
 	end
 
 	session.conn = request.conn;
+	session.stream = context.stream;
+
+	if session.stanza_size_limit then
+		session.stream:set_stanza_size_limit(session.stanza_size_limit);
+	end
 
 	if session.rid then
 		local diff = rid - session.rid;
@@ -544,6 +551,7 @@
 end
 
 function module.add_host(module)
+	module:depends("c2s"); -- updates stanza_size_limit on authentication
 	module:depends("http");
 	module:provides("http", {
 		default_path = "/http-bind";