[JuliusHenke]

Summary

• New RequestBodyLimitConfig: a filter on all paths that caps request bodies at app.http.request.max-body-bytes (default 1 MiB). A declared Content-Length above the limit gets 413 without the body being read. Bodies without a length (chunked) get 413 once they exceed the limit.
• application.yml: Jackson read constraints via spring.jackson.factory.constraints.read.*. Document length is capped at the same size and the token count at 60 000. The largest expected request is 50 000 relay IDs, about 0.5 MiB.
• backend/README.md: new "Reverse proxy" section recommending a matching body size limit (e.g. nginx client_max_body_size 1m;).
• THREAT_MODEL.md: lists the limits under existing controls, assumptions and the review checklist.

Tests

• New RequestBodyLimitTest:
  • a body over the limit with Content-Length gets 413;
  • a chunked body over the limit, sent to the real server, gets 413;
  • a body under the size limit with too many JSON tokens gets 400 before validation runs;
  • the largest accepted relay ID list (50 000 IDs) still gets 200.
• ./gradlew test: all 122 tests pass.

Dependencies

No dependencies were added or changed, so no vetting or SCA was needed. Snyk SAST was not run locally, because it needs maintainer authentication. The Snyk PR checks still apply.

---

Generated by Claude Code

[JuliusHenke]

code/snyk (JuliusHenke) reports an error, "Code test limit reached". That means the Snyk Code test quota for the account has run out. It isn't a finding in this diff, and no push from this PR can fix it. security/snyk passed. I can't re-run the check from here. It needs a re-run from the Snyk dashboard once the quota resets, or a local ./gradlew snykCode by a maintainer with an authenticated CLI.

---

Generated by Claude Code