Added the ability to set totalCountHeader on a specific request #332
Conversation
|
I'll take a closer look as soon as possible, thanks for your contribution! |
|
While this solution solves your issue on the surface, a malicious client could simply remove the query parameter, notice the difference in response time and then you're back to square one: vulnerable to DoS. I do like the idea but I think step one would be to add the ability to set the count header per endpoint and then expose a way to set it dynamically on the server, probably somewhere in |
| totalCountHeader = options.totalCountHeader; | ||
| } | ||
|
|
||
| if (totalCountHeader && !req._ermQueryOptions['distinct']) { |
There was a problem hiding this comment.
Codacy has a fix for the issue: Strings must use doublequote.
| if (totalCountHeader && !req._ermQueryOptions['distinct']) { | |
| if (totalCountHeader && !req._ermQueryOptions["distinct"]) { |
| req.erm.result = items | ||
| req.erm.statusCode = 200 | ||
|
|
||
| if (options.totalCountHeader && !req._ermQueryOptions['distinct']) { | ||
| if (req.query.totalCountHeader === 'true') { |
There was a problem hiding this comment.
Codacy has a fix for the issue: Strings must use doublequote.
| if (req.query.totalCountHeader === 'true') { | |
| if (req.query.totalCountHeader === "true") { |
| if (options.totalCountHeader && !req._ermQueryOptions['distinct']) { | ||
| if (req.query.totalCountHeader === 'true') { | ||
| totalCountHeader = true; | ||
| } else if (req.query.totalCountHeader === 'false') { |
There was a problem hiding this comment.
Codacy has a fix for the issue: Strings must use doublequote.
| } else if (req.query.totalCountHeader === 'false') { | |
| } else if (req.query.totalCountHeader === "false") { |
The point of this is to be able to set totalCountHeader on specific requests. We have been dealing with larger collections where some of the queries count is not performant, and do not want it to run on.