Every endpoint that accepts a request body or file upload must have a maximum size limit, enforced before the body is parsed or processed. An unlimited file upload endpoint can be used to fill disk space, exhaust memory during parsing, or saturate upload bandwidth.
• JSON request bodies: typically 1MB–10MB depending on the use case. Most CRUD endpoints don't need more than 1MB.
• File uploads: define per-type limits (profile photo: 5MB, document: 10MB, video: 500MB) and enforce them before writing to disk or triggering processing.
• GraphQL mutation inputs: same rule as JSON bodies.
At the web server or API gateway layer — before the request reaches application code. In nginx: client_max_body_size 10m;. In Express: express.json({ limit: '1mb' }). In Django: DATA_UPLOAD_MAX_MEMORY_SIZE. Enforcing at the framework layer prevents the application from spending CPU parsing a 100GB body.
When a request exceeds the size limit, return HTTP 413 Payload Too Large with a clear error message indicating the maximum allowed size. This is a standard HTTP response that legitimate clients can handle gracefully.
Ask your team whether any API endpoint can return an unlimited number of records in a single response. Every list or search endpoint should have a hard maximum on how many results it returns at once.