Fix Unrestricted Resource Consumption in Beego

Unrestricted resource consumption in Beego typically manifests as memory exhaustion (OOM) or disk filling via oversized request bodies and slow-rate attacks. If you don't explicitly cap the input stream and set socket timeouts, an attacker can easily pin your CPU or deplete your RAM by sending multi-gigabyte payloads or maintaining thousands of slow, hanging connections.

The Vulnerable Pattern

package controllers
import “github.com/beego/beego/v2/server/web”
type ProcessController struct {
web.Controller
}
func (c *ProcessController) Post() {
// VULNERABLE: Default Beego configuration allows large payloads.
// If BConfig.CopyRequestBody is true and no limit is set,
// an attacker can OOM the service by sending a massive JSON body.
data := c.Ctx.Input.RequestBody
c.Ctx.Output.Body(data)
}

The Secure Implementation

The remediation strategy focuses on three layers of defense. First, 'MaxRequestBodySize' acts as a hard ceiling for incoming data, preventing OOM during body parsing. Second, 'MaxMemory' controls the buffer size for multipart uploads; exceeding this value forces Beego to use temporary files instead of RAM. Third, setting 'ReadTimeout' and 'WriteTimeout' ensures that connections are dropped if the client is intentionally slow, preventing file descriptor exhaustion. Always prefer framework-level constraints over manual checks inside controllers to ensure the protection is applied before the payload is fully buffered.

package main
import (
“github.com/beego/beego/v2/server/web”
)
func main() {
// SECURE: Global resource limits enforced at the config level.
// 1. Limit the maximum request body size (e.g., 2MB)
web.BConfig.MaxRequestBodySize = 2 * 1024 * 1024

// 2. Limit memory usage for multipart forms (e.g., 1MB)
web.BConfig.MaxMemory = 1 << 20

// 3. Set strict timeouts to prevent Slowloris attacks
web.BConfig.Listen.ReadTimeout = 10
web.BConfig.Listen.WriteTimeout = 10

// 4. Disable body copying for high-throughput endpoints if not needed
web.BConfig.CopyRequestBody = false

web.Run()
}