JHipster generated entity list pagination without enforced maximum page size

JHipster pagination: max page size, defaults and limits

JHipster scaffolds Spring Data JPA repositories and REST resources that expose list endpoints with Spring Data Pageable. The generated methods accept page, size and sort query parameters and return org.springframework.data.domain.Page, which JPA/Hibernate translates to LIMIT/OFFSET SQL. By default, no global maximum page size is enforced, and clients can request arbitrarily large sizes unless the application configuration provides a cap.

Confirmed facts

• Spring Data Web’s PageableHandlerMethodArgumentResolver honors the spring.data.web.pageable.max-page-size property. Setting this in application.yml or application.properties caps the size request parameter for all Pageable-driven endpoints, including JHipster-generated *Resource list methods.
• If spring.data.web.pageable.default-page-size is not explicitly defined, the generated REST controllers inherit Spring Data Web’s default of 20 items per page. JHipster does not override this value in its generated code.
• Generated entity list methods are not annotated with role-specific page-size restrictions. No @PreAuthorize or security filter is generated to limit page size by role; any user with endpoint access can request any size up to the global maximum.

Likely explanation

JHipster delegates pagination behavior to Spring Data Web. The generator provides repository and resource scaffolding but does not configure global pagination bounds or role-based size limits, relying on the application developer to add them.

Steps for this case

1. Inspect application.yml or application.properties for spring.data.web.pageable.max-page-size and spring.data.web.pageable.default-page-size. If both are absent, the Spring Data Web defaults are in effect.
2. To enforce a cap, add an explicit configuration such as spring.data.web.pageable.max-page-size=100 and spring.data.web.pageable.default-page-size=20 in the application configuration file, then restart the Spring Boot application; the PageableHandlerMethodArgumentResolver is created at startup and adopts the new values.
3. Verify the cap by calling an entity list endpoint with ?size=9999. The returned Page should contain a size equal to the configured max (e.g., 100), confirming the limit.
4. Check the generated resource class, e.g., EntityResource.java, for any @PreAuthorize or security annotation on the list method. Absence confirms no role-based size restriction is generated.

Diagnostic detail that changes the recommendation: JHipster and Spring Boot version. Property names and defaults are version-sensitive across JHipster major releases, and a JHipster-specific pageable property may exist in newer versions. Could you confirm the JHipster version in use?