1. <?php
  3. /**
  4. * Enforces limits on HTTP header metadata based on a configuration file.
  5. *
  6. * @param array $config Configuration array.
  7. */
  8. function enforceHeaderLimits(array $config): void
  9. {
  10. // Default configuration
  11. $defaultConfig = [
  12. 'max_content_length' => 1024 * 1024, // 1MB default
  13. 'max_connection_heads' => 100,
  14. 'max_date_unparsed' => 3600, // 1 hour
  15. 'max_pipelined_requests' => 10,
  16. 'max_transfer_forwards' => 5,
  17. ];
  19. // Merge default config with provided config
  20. $config = array_merge($defaultConfig, $config);
  22. // Check and enforce max-content-length
  23. if (isset($config['max_content_length'])) {
  24. if (headers_ envoyé) {
  25. if (empty($_SERVER['CONTENT_LENGTH'])) {
  26. $_SERVER['CONTENT_LENGTH'] = 0;
  27. }
  28. if ($_SERVER['CONTENT_LENGTH'] > $config['max_content_length']) {
  29. header('HTTP/1.1 413 Payload Too Large');
  30. exit('Payload too large. Maximum allowed size is ' . $config['max_content_length'] . ' bytes.');
  31. }
  32. }
  33. }
  35. // Check and enforce max-connection-heads
  36. if (isset($config['max_connection_heads'])) {
  37. if (count($_SERVER['HTTP_CONNECTION_HEADS']) > $config['max_connection_heads']) {
  38. header('HTTP/1.1 429 Too Many Connections');
  39. exit('Too many connections. Maximum allowed is ' . $config['max_connection_heads']);
  40. }
  41. }
  43. // Check and enforce max-date-unparsed
  44. if (isset($config['max_date_unparsed'])) {
  45. $date = isset($_SERVER['HTTP_DATE']) ? $_SERVER['HTTP_DATE'] : null;
  46. if ($date) {
  47. $date_timestamp = strtotime($date);
  48. if ($date_timestamp === false || $date_timestamp < time() - $config['max_date_unparsed']) {
  49. header('HTTP/1.1 410 Gone');
  50. exit('Date is too far in the past. Maximum allowed age is ' . $config['max_date_unparsed'] . ' seconds.');
  51. }
  52. }
  53. }
  55. // Check and enforce max-pipelined-requests
  56. if (isset($config['max_pipelined_requests'])) {
  57. if (count($_SERVER['HTTP_PIPELINED_REQUESTS']) > $config['max_pipelined_requests']) {
  58. header('HTTP/1.1 429 Too Many Pipelined Requests');
  59. exit('Too many pipelined requests. Maximum allowed is ' . $config['max_pipelined_requests']);
  60. }
  61. }
  63. // Check and enforce max-transfer-forwards
  64. if (isset($config['max_transfer_forwards'])) {
  65. if (count($_SERVER['HTTP_TRANSFER_FORWARDS']) > $config['max_transfer_forwards']) {
  66. header('HTTP/1.1 429 Too Many Forwarded Requests');
  67. exit('Too many forwarded requests. Maximum allowed is ' . $config['max_transfer_forwards']);
  68. }
  69. }
  70. }
  72. // Example usage (assuming config file exists)
  73. // Read configuration from file (example)
  74. $config = require 'config.php'; // Create config.php with your settings
  76. //Enforce limits
  77. enforceHeaderLimits($config);
  79. ?>

Add your comment