Does JHipster-generated Spring Data REST enforce a maximum page size to prevent memory exhaustion?

Answer

No, the JHipster‑generated Spring Data REST endpoints do not automatically limit the size parameter of Pageable requests. Unless you explicitly configure a maximum page size, a client can request an arbitrarily large page (e.g., ?size=999999) and the application will attempt to load that many rows into memory, which can lead to OutOfMemoryError.

Confirmed facts

• Spring Data REST uses the Pageable value supplied by the client; if omitted it falls back to the default page size (20 in JHipster’s generated application.yml).
• There is no built‑in handler that rejects oversized Pageable objects before they reach the repository.
• Spring Boot provides the property spring.data.rest.max-page-size to impose an upper limit. If the property is absent or set to -1, no limit is applied.
• The JHipster generator does not add a RepositoryRestConfigurer bean or a customized PageableHandlerMethodArgumentResolver that calls setMaxPageSize. Therefore the default unrestricted behavior remains unless you add such configuration yourself.

Steps to verify and enforce a limit

1. Check for an existing max‑page‑size setting: open src/main/resources/application.yml (and any profile‑specific files) and look for the key spring.data.rest.max-page-size. If it is present with a positive integer, that value is the enforced limit.
2. If the property is missing or set to -1, no global limit is active.
3. Optional: search the Java sources for any class implementing RepositoryRestConfigurer or declaring a PageableHandlerMethodArgumentResolver bean that calls setMaxPageSize. If none exist, the limit is not enforced.
4. To enforce a limit without touching generated controller code, add one of the following:
   • In application.yml:

   spring:
     data:
       rest:
         max-page-size: 100   # adjust as needed

5. Or define a configuration bean:

@Configuration
public class RestConfig implements RepositoryRestConfigurer {
    @Override
    public void configureRepositoryRestConfiguration(RepositoryRestConfiguration config, CorsRegistry cors) {
        config.setMaxPageSize(100);
    }
}

6. Restart the application for the change to take effect.
7. Verify by calling an endpoint with a large size, e.g., GET /api/entities?size=999999. The response should contain at most the configured max page size (or the default page size if no size was supplied).

Missing diagnostic detail

If you already have a RepositoryRestConfigurer bean defined elsewhere, check whether it sets a max page size. Knowing the presence and content of such a bean determines whether you need to add new configuration or simply adjust the existing one.