X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/9f81dc57445cd51b92e34a82742765788c35620c..c4baa0a1c57c5b9aa5d08a5d3d1f50eca842d3f7:/lib/controller/router/router.go

diff --git a/lib/controller/router/router.go b/lib/controller/router/router.go
index f5db9426b8..d39f493a95 100644
--- a/lib/controller/router/router.go
+++ b/lib/controller/router/router.go
@@ -7,6 +7,7 @@ package router
 import (
 	"context"
 	"fmt"
+	"math"
 	"net/http"
 	"strings"
 
@@ -20,24 +21,32 @@ import (
 )
 
 type router struct {
-	mux       *mux.Router
-	backend   arvados.API
-	wrapCalls func(api.RoutableFunc) api.RoutableFunc
+	mux     *mux.Router
+	backend arvados.API
+	config  Config
+}
+
+type Config struct {
+	// Return an error if request body exceeds this size. 0 means
+	// unlimited.
+	MaxRequestSize int
+
+	// If wrapCalls is not nil, it is called once for each API
+	// method, and the returned method is used in its place. This
+	// can be used to install hooks before and after each API call
+	// and alter responses; see localdb.WrapCallsInTransaction for
+	// an example.
+	WrapCalls func(api.RoutableFunc) api.RoutableFunc
 }
 
 // New returns a new router (which implements the http.Handler
 // interface) that serves requests by calling Arvados API methods on
 // the given backend.
-//
-// If wrapCalls is not nil, it is called once for each API method, and
-// the returned method is used in its place. This can be used to
-// install hooks before and after each API call and alter responses;
-// see localdb.WrapCallsInTransaction for an example.
-func New(backend arvados.API, wrapCalls func(api.RoutableFunc) api.RoutableFunc) *router {
+func New(backend arvados.API, config Config) *router {
 	rtr := &router{
-		mux:       mux.NewRouter(),
-		backend:   backend,
-		wrapCalls: wrapCalls,
+		mux:     mux.NewRouter(),
+		backend: backend,
+		config:  config,
 	}
 	rtr.addRoutes()
 	return rtr
@@ -56,6 +65,13 @@ func (rtr *router) addRoutes() {
 				return rtr.backend.ConfigGet(ctx)
 			},
 		},
+		{
+			arvados.EndpointVocabularyGet,
+			func() interface{} { return &struct{}{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.VocabularyGet(ctx)
+			},
+		},
 		{
 			arvados.EndpointLogin,
 			func() interface{} { return &arvados.LoginOptions{} },
@@ -70,6 +86,41 @@ func (rtr *router) addRoutes() {
 				return rtr.backend.Logout(ctx, *opts.(*arvados.LogoutOptions))
 			},
 		},
+		{
+			arvados.EndpointAuthorizedKeyCreate,
+			func() interface{} { return &arvados.CreateOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.AuthorizedKeyCreate(ctx, *opts.(*arvados.CreateOptions))
+			},
+		},
+		{
+			arvados.EndpointAuthorizedKeyUpdate,
+			func() interface{} { return &arvados.UpdateOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.AuthorizedKeyUpdate(ctx, *opts.(*arvados.UpdateOptions))
+			},
+		},
+		{
+			arvados.EndpointAuthorizedKeyGet,
+			func() interface{} { return &arvados.GetOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.AuthorizedKeyGet(ctx, *opts.(*arvados.GetOptions))
+			},
+		},
+		{
+			arvados.EndpointAuthorizedKeyList,
+			func() interface{} { return &arvados.ListOptions{Limit: -1} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.AuthorizedKeyList(ctx, *opts.(*arvados.ListOptions))
+			},
+		},
+		{
+			arvados.EndpointAuthorizedKeyDelete,
+			func() interface{} { return &arvados.DeleteOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.AuthorizedKeyDelete(ctx, *opts.(*arvados.DeleteOptions))
+			},
+		},
 		{
 			arvados.EndpointCollectionCreate,
 			func() interface{} { return &arvados.CreateOptions{} },
@@ -140,6 +191,13 @@ func (rtr *router) addRoutes() {
 				return rtr.backend.ContainerCreate(ctx, *opts.(*arvados.CreateOptions))
 			},
 		},
+		{
+			arvados.EndpointContainerPriorityUpdate,
+			func() interface{} { return &arvados.UpdateOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.ContainerPriorityUpdate(ctx, *opts.(*arvados.UpdateOptions))
+			},
+		},
 		{
 			arvados.EndpointContainerUpdate,
 			func() interface{} { return &arvados.UpdateOptions{} },
@@ -168,6 +226,63 @@ func (rtr *router) addRoutes() {
 				return rtr.backend.ContainerDelete(ctx, *opts.(*arvados.DeleteOptions))
 			},
 		},
+		{
+			arvados.EndpointContainerLock,
+			func() interface{} {
+				return &arvados.GetOptions{Select: []string{"uuid", "state", "priority", "auth_uuid", "locked_by_uuid"}}
+			},
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.ContainerLock(ctx, *opts.(*arvados.GetOptions))
+			},
+		},
+		{
+			arvados.EndpointContainerUnlock,
+			func() interface{} {
+				return &arvados.GetOptions{Select: []string{"uuid", "state", "priority", "auth_uuid", "locked_by_uuid"}}
+			},
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.ContainerUnlock(ctx, *opts.(*arvados.GetOptions))
+			},
+		},
+		{
+			arvados.EndpointContainerSSH,
+			func() interface{} { return &arvados.ContainerSSHOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.ContainerSSH(ctx, *opts.(*arvados.ContainerSSHOptions))
+			},
+		},
+		{
+			arvados.EndpointContainerSSHCompat,
+			func() interface{} { return &arvados.ContainerSSHOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.ContainerSSH(ctx, *opts.(*arvados.ContainerSSHOptions))
+			},
+		},
+		{
+			// arvados-client built before commit
+			// bdc29d3129f6d75aa9ce0a24ffb849a272b06f08
+			// used GET with params in headers instead of
+			// POST form
+			arvados.APIEndpoint{"GET", "arvados/v1/connect/{uuid}/ssh", ""},
+			func() interface{} { return &arvados.ContainerSSHOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return nil, httpError(http.StatusGone, fmt.Errorf("API endpoint is obsolete -- please upgrade your arvados-client program"))
+			},
+		},
+		{
+			arvados.EndpointContainerGatewayTunnel,
+			func() interface{} { return &arvados.ContainerGatewayTunnelOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.ContainerGatewayTunnel(ctx, *opts.(*arvados.ContainerGatewayTunnelOptions))
+			},
+		},
+		{
+			arvados.EndpointContainerGatewayTunnelCompat,
+			func() interface{} { return &arvados.ContainerGatewayTunnelOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.ContainerGatewayTunnel(ctx, *opts.(*arvados.ContainerGatewayTunnelOptions))
+			},
+		},
 		{
 			arvados.EndpointContainerRequestCreate,
 			func() interface{} { return &arvados.CreateOptions{} },
@@ -204,42 +319,52 @@ func (rtr *router) addRoutes() {
 			},
 		},
 		{
-			arvados.EndpointContainerLock,
-			func() interface{} {
-				return &arvados.GetOptions{Select: []string{"uuid", "state", "priority", "auth_uuid", "locked_by_uuid"}}
+			arvados.EndpointContainerRequestLog,
+			func() interface{} { return &arvados.ContainerLogOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.ContainerRequestLog(ctx, *opts.(*arvados.ContainerLogOptions))
 			},
+		},
+		{
+			arvados.EndpointGroupCreate,
+			func() interface{} { return &arvados.CreateOptions{} },
 			func(ctx context.Context, opts interface{}) (interface{}, error) {
-				return rtr.backend.ContainerLock(ctx, *opts.(*arvados.GetOptions))
+				return rtr.backend.GroupCreate(ctx, *opts.(*arvados.CreateOptions))
 			},
 		},
 		{
-			arvados.EndpointContainerUnlock,
-			func() interface{} {
-				return &arvados.GetOptions{Select: []string{"uuid", "state", "priority", "auth_uuid", "locked_by_uuid"}}
+			arvados.EndpointGroupUpdate,
+			func() interface{} { return &arvados.UpdateOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.GroupUpdate(ctx, *opts.(*arvados.UpdateOptions))
 			},
+		},
+		{
+			arvados.EndpointGroupList,
+			func() interface{} { return &arvados.ListOptions{Limit: -1} },
 			func(ctx context.Context, opts interface{}) (interface{}, error) {
-				return rtr.backend.ContainerUnlock(ctx, *opts.(*arvados.GetOptions))
+				return rtr.backend.GroupList(ctx, *opts.(*arvados.ListOptions))
 			},
 		},
 		{
-			arvados.EndpointContainerSSH,
-			func() interface{} { return &arvados.ContainerSSHOptions{} },
+			arvados.EndpointGroupContents,
+			func() interface{} { return &arvados.GroupContentsOptions{Limit: -1} },
 			func(ctx context.Context, opts interface{}) (interface{}, error) {
-				return rtr.backend.ContainerSSH(ctx, *opts.(*arvados.ContainerSSHOptions))
+				return rtr.backend.GroupContents(ctx, *opts.(*arvados.GroupContentsOptions))
 			},
 		},
 		{
-			arvados.EndpointGroupCreate,
-			func() interface{} { return &arvados.CreateOptions{} },
+			arvados.EndpointGroupContentsUUIDInPath,
+			func() interface{} { return &arvados.GroupContentsOptions{Limit: -1} },
 			func(ctx context.Context, opts interface{}) (interface{}, error) {
-				return rtr.backend.GroupCreate(ctx, *opts.(*arvados.CreateOptions))
+				return rtr.backend.GroupContents(ctx, *opts.(*arvados.GroupContentsOptions))
 			},
 		},
 		{
-			arvados.EndpointGroupUpdate,
-			func() interface{} { return &arvados.UpdateOptions{} },
+			arvados.EndpointGroupShared,
+			func() interface{} { return &arvados.ListOptions{Limit: -1} },
 			func(ctx context.Context, opts interface{}) (interface{}, error) {
-				return rtr.backend.GroupUpdate(ctx, *opts.(*arvados.UpdateOptions))
+				return rtr.backend.GroupShared(ctx, *opts.(*arvados.ListOptions))
 			},
 		},
 		{
@@ -250,38 +375,94 @@ func (rtr *router) addRoutes() {
 			},
 		},
 		{
-			arvados.EndpointGroupList,
-			func() interface{} { return &arvados.ListOptions{Limit: -1} },
+			arvados.EndpointGroupDelete,
+			func() interface{} { return &arvados.DeleteOptions{} },
 			func(ctx context.Context, opts interface{}) (interface{}, error) {
-				return rtr.backend.GroupList(ctx, *opts.(*arvados.ListOptions))
+				return rtr.backend.GroupDelete(ctx, *opts.(*arvados.DeleteOptions))
 			},
 		},
 		{
-			arvados.EndpointGroupContents,
-			func() interface{} { return &arvados.ListOptions{Limit: -1} },
+			arvados.EndpointGroupTrash,
+			func() interface{} { return &arvados.DeleteOptions{} },
 			func(ctx context.Context, opts interface{}) (interface{}, error) {
-				return rtr.backend.GroupContents(ctx, *opts.(*arvados.ContentsOptions))
+				return rtr.backend.GroupTrash(ctx, *opts.(*arvados.DeleteOptions))
 			},
 		},
 		{
-			arvados.EndpointGroupShared,
+			arvados.EndpointGroupUntrash,
+			func() interface{} { return &arvados.UntrashOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.GroupUntrash(ctx, *opts.(*arvados.UntrashOptions))
+			},
+		},
+		{
+			arvados.EndpointLinkCreate,
+			func() interface{} { return &arvados.CreateOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.LinkCreate(ctx, *opts.(*arvados.CreateOptions))
+			},
+		},
+		{
+			arvados.EndpointLinkUpdate,
+			func() interface{} { return &arvados.UpdateOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.LinkUpdate(ctx, *opts.(*arvados.UpdateOptions))
+			},
+		},
+		{
+			arvados.EndpointLinkList,
 			func() interface{} { return &arvados.ListOptions{Limit: -1} },
 			func(ctx context.Context, opts interface{}) (interface{}, error) {
-				return rtr.backend.GroupShared(ctx, *opts.(*arvados.SharedOptions))
+				return rtr.backend.LinkList(ctx, *opts.(*arvados.ListOptions))
 			},
 		},
 		{
-			arvados.EndpointGroupDelete,
+			arvados.EndpointLinkGet,
+			func() interface{} { return &arvados.GetOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.LinkGet(ctx, *opts.(*arvados.GetOptions))
+			},
+		},
+		{
+			arvados.EndpointLinkDelete,
 			func() interface{} { return &arvados.DeleteOptions{} },
 			func(ctx context.Context, opts interface{}) (interface{}, error) {
-				return rtr.backend.GroupDelete(ctx, *opts.(*arvados.DeleteOptions))
+				return rtr.backend.LinkDelete(ctx, *opts.(*arvados.DeleteOptions))
 			},
 		},
 		{
-			arvados.EndpointGroupUntrash,
-			func() interface{} { return &arvados.UntrashOptions{} },
+			arvados.EndpointLogCreate,
+			func() interface{} { return &arvados.CreateOptions{} },
 			func(ctx context.Context, opts interface{}) (interface{}, error) {
-				return rtr.backend.GroupUntrash(ctx, *opts.(*arvados.UntrashOptions))
+				return rtr.backend.LogCreate(ctx, *opts.(*arvados.CreateOptions))
+			},
+		},
+		{
+			arvados.EndpointLogUpdate,
+			func() interface{} { return &arvados.UpdateOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.LogUpdate(ctx, *opts.(*arvados.UpdateOptions))
+			},
+		},
+		{
+			arvados.EndpointLogList,
+			func() interface{} { return &arvados.ListOptions{Limit: -1} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.LogList(ctx, *opts.(*arvados.ListOptions))
+			},
+		},
+		{
+			arvados.EndpointLogGet,
+			func() interface{} { return &arvados.GetOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.LogGet(ctx, *opts.(*arvados.GetOptions))
+			},
+		},
+		{
+			arvados.EndpointLogDelete,
+			func() interface{} { return &arvados.DeleteOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.LogDelete(ctx, *opts.(*arvados.DeleteOptions))
 			},
 		},
 		{
@@ -319,6 +500,48 @@ func (rtr *router) addRoutes() {
 				return rtr.backend.SpecimenDelete(ctx, *opts.(*arvados.DeleteOptions))
 			},
 		},
+		{
+			arvados.EndpointAPIClientAuthorizationCreate,
+			func() interface{} { return &arvados.CreateOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.APIClientAuthorizationCreate(ctx, *opts.(*arvados.CreateOptions))
+			},
+		},
+		{
+			arvados.EndpointAPIClientAuthorizationUpdate,
+			func() interface{} { return &arvados.UpdateOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.APIClientAuthorizationUpdate(ctx, *opts.(*arvados.UpdateOptions))
+			},
+		},
+		{
+			arvados.EndpointAPIClientAuthorizationDelete,
+			func() interface{} { return &arvados.DeleteOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.APIClientAuthorizationDelete(ctx, *opts.(*arvados.DeleteOptions))
+			},
+		},
+		{
+			arvados.EndpointAPIClientAuthorizationList,
+			func() interface{} { return &arvados.ListOptions{Limit: -1} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.APIClientAuthorizationList(ctx, *opts.(*arvados.ListOptions))
+			},
+		},
+		{
+			arvados.EndpointAPIClientAuthorizationCurrent,
+			func() interface{} { return &arvados.GetOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.APIClientAuthorizationCurrent(ctx, *opts.(*arvados.GetOptions))
+			},
+		},
+		{
+			arvados.EndpointAPIClientAuthorizationGet,
+			func() interface{} { return &arvados.GetOptions{} },
+			func(ctx context.Context, opts interface{}) (interface{}, error) {
+				return rtr.backend.APIClientAuthorizationGet(ctx, *opts.(*arvados.GetOptions))
+			},
+		},
 		{
 			arvados.EndpointUserCreate,
 			func() interface{} { return &arvados.CreateOptions{} },
@@ -375,13 +598,6 @@ func (rtr *router) addRoutes() {
 				return rtr.backend.UserGet(ctx, *opts.(*arvados.GetOptions))
 			},
 		},
-		{
-			arvados.EndpointUserUpdateUUID,
-			func() interface{} { return &arvados.UpdateUUIDOptions{} },
-			func(ctx context.Context, opts interface{}) (interface{}, error) {
-				return rtr.backend.UserUpdateUUID(ctx, *opts.(*arvados.UpdateUUIDOptions))
-			},
-		},
 		{
 			arvados.EndpointUserUpdate,
 			func() interface{} { return &arvados.UpdateOptions{} },
@@ -419,15 +635,29 @@ func (rtr *router) addRoutes() {
 		},
 	} {
 		exec := route.exec
-		if rtr.wrapCalls != nil {
-			exec = rtr.wrapCalls(exec)
+		if rtr.config.WrapCalls != nil {
+			exec = rtr.config.WrapCalls(exec)
 		}
 		rtr.addRoute(route.endpoint, route.defaultOpts, exec)
 	}
 	rtr.mux.NotFoundHandler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		if req.Method == "OPTIONS" {
+			// For non-webdav endpoints, return an empty
+			// response with the CORS headers we already
+			// added in ServeHTTP.
+			w.WriteHeader(http.StatusOK)
+			return
+		}
 		httpserver.Errors(w, []string{"API endpoint not found"}, http.StatusNotFound)
 	})
 	rtr.mux.MethodNotAllowedHandler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		if req.Method == "OPTIONS" {
+			// For non-webdav endpoints, return an empty
+			// response with the CORS headers we already
+			// added in ServeHTTP.
+			w.WriteHeader(http.StatusOK)
+			return
+		}
 		httpserver.Errors(w, []string{"API endpoint not found"}, http.StatusMethodNotAllowed)
 	})
 }
@@ -442,9 +672,14 @@ func (rtr *router) addRoute(endpoint arvados.APIEndpoint, defaultOpts func() int
 	if alt, ok := altMethod[endpoint.Method]; ok {
 		methods = append(methods, alt)
 	}
+	if strings.HasSuffix(endpoint.Path, ".*}") {
+		// webdav methods
+		methods = append(methods, "OPTIONS", "PROPFIND")
+	}
 	rtr.mux.Methods(methods...).Path("/" + endpoint.Path).HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 		logger := ctxlog.FromContext(req.Context())
-		params, err := rtr.loadRequestParams(req, endpoint.AttrsKey)
+		opts := defaultOpts()
+		params, err := rtr.loadRequestParams(req, endpoint.AttrsKey, opts)
 		if err != nil {
 			logger.WithFields(logrus.Fields{
 				"req":      req,
@@ -454,13 +689,6 @@ func (rtr *router) addRoute(endpoint arvados.APIEndpoint, defaultOpts func() int
 			rtr.sendError(w, err)
 			return
 		}
-		opts := defaultOpts()
-		err = rtr.transcode(params, opts)
-		if err != nil {
-			logger.WithField("params", params).WithError(err).Debugf("error transcoding params to %T", opts)
-			rtr.sendError(w, err)
-			return
-		}
 		respOpts, err := rtr.responseOptions(opts)
 		if err != nil {
 			logger.WithField("opts", opts).WithError(err).Debugf("error getting response options from %T", opts)
@@ -483,6 +711,26 @@ func (rtr *router) addRoute(endpoint arvados.APIEndpoint, defaultOpts func() int
 		}
 		ctx := auth.NewContext(req.Context(), creds)
 		ctx = arvados.ContextWithRequestID(ctx, req.Header.Get("X-Request-Id"))
+		req = req.WithContext(ctx)
+
+		// Extract the token UUIDs (or a placeholder for v1 tokens)
+		var tokenUUIDs []string
+		for _, t := range creds.Tokens {
+			if strings.HasPrefix(t, "v2/") {
+				tokenParts := strings.Split(t, "/")
+				if len(tokenParts) >= 3 {
+					tokenUUIDs = append(tokenUUIDs, tokenParts[1])
+				}
+			} else {
+				end := t
+				if len(t) > 5 {
+					end = t[len(t)-5:]
+				}
+				tokenUUIDs = append(tokenUUIDs, "v1 token ending in "+end)
+			}
+		}
+		httpserver.SetResponseLogFields(ctx, logrus.Fields{"tokenUUIDs": tokenUUIDs})
+
 		logger.WithFields(logrus.Fields{
 			"apiEndpoint": endpoint,
 			"apiOptsType": fmt.Sprintf("%T", opts),
@@ -503,15 +751,31 @@ func (rtr *router) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	case "login", "logout", "auth":
 	default:
 		w.Header().Set("Access-Control-Allow-Origin", "*")
-		w.Header().Set("Access-Control-Allow-Methods", "GET, HEAD, PUT, POST, PATCH, DELETE")
-		w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type, X-Http-Method-Override")
+		w.Header().Set("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS, PROPFIND, PUT, POST, PATCH, DELETE")
+		w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type, Range, X-Http-Method-Override")
+		w.Header().Set("Access-Control-Expose-Headers", "Content-Range")
 		w.Header().Set("Access-Control-Max-Age", "86486400")
 	}
-	if r.Method == "OPTIONS" {
-		return
+	if r.Body != nil {
+		// Wrap r.Body in a http.MaxBytesReader(), otherwise
+		// r.ParseForm() uses a default max request body size
+		// of 10 megabytes. Note we rely on the Nginx
+		// configuration to enforce the real max body size.
+		max := int64(rtr.config.MaxRequestSize)
+		if max < 1 {
+			max = math.MaxInt64 - 1
+		}
+		r.Body = http.MaxBytesReader(w, r.Body, max)
 	}
 	if r.Method == "POST" {
-		r.ParseForm()
+		err := r.ParseForm()
+		if err != nil {
+			if err.Error() == "http: request body too large" {
+				err = httpError(http.StatusRequestEntityTooLarge, err)
+			}
+			rtr.sendError(w, err)
+			return
+		}
 		if m := r.FormValue("_method"); m != "" {
 			r2 := *r
 			r = &r2