JHipster Repository ↔ Spring Data JPA Pageable: How to enforce a global max page size?
0 reputation · 14 Dec 2024, 01:39 UTC
0 reputation · 14 Dec 2024, 01:39 UTC
In a JHipster‑generated application the REST controllers expose CRUD endpoints that accept a Pageable object. The controller delegates to a Spring Data JPA repository and uses PaginationUtil to add X‑Total‑Count and Link headers. The framework accepts any pageSize value supplied by the client; the default is 20 but larger values are not capped.
Because the generated code does not impose a hard limit, a very large pageSize can lead to excessive memory consumption, long query times, and potential denial‑of‑service. The application has no global configuration to enforce a maximum, and any custom validation would need to be applied consistently across all endpoints while preserving the correct pagination metadata.
What is the recommended approach to enforce a global maximum page size in a JHipster application that uses Spring Data JPA Pageable? Should the solution be a custom Pageable implementation, a request filter, or a global exception handler that validates the size? How can the chosen method coexist with PaginationUtil so that the X‑Total‑Count and Link headers remain accurate?
32775 reputation · 14 Dec 2024, 11:41 UTC
The simplest, most reliable way to limit the page size in a JHipster application is to set the Spring Boot property spring.data.web.pageable.max-page-size (and optionally default-page-size) in application.yml or application.properties. Spring’s PageableHandlerMethodArgumentResolver reads this property before the controller is invoked, so the Pageable object that reaches the repository and PaginationUtil already contains the capped size. The pagination metadata (total count, link headers) remains correct because it is computed from that same Pageable instance.
page=0 as the first page.Pageable implementations, request filters, or global exception handlers that would have to replicate the same logic and could mis‑align the link headers.src/main/resources/application.yml (or application.properties). Add or update the following lines:
spring:
data:
web:
pageable:
max-page-size: 100 # maximum rows a client can request
default-page-size: 20 # optional default
PageableHandlerMethodArgumentResolver bean. If such a bean exists, remove or adjust it so that the resolver’s setMaxPageSize method uses the same value./api/users?page=0&size=1000 and confirm the response body contains only 100 records and that the Link header reflects size=100.If your project uses Spring Boot 2.4 or earlier, the max-page-size property is not exposed. In that case you can create a small configuration class to supply a customized resolver:
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.web.PageableHandlerMethodArgumentResolver;
@Configuration
public class PageableConfig {
@Bean
public PageableHandlerMethodArgumentResolver pageableResolver() {
PageableHandlerMethodArgumentResolver resolver = new PageableHandlerMethodArgumentResolver();
resolver.setMaxPageSize(100); // your desired cap
resolver.setOneIndexedParameters(true); // keep JHipster’s 0‑based page handling
return resolver;
}
}
After adding this bean, the resolver will enforce the cap before any controller method is invoked, and the rest of the stack behaves as if the property had been set.
pom.xml (or build.gradle). The property is available from Spring Boot 2.6+; earlier versions require the custom bean.PageableHandlerMethodArgumentResolver bean or a filter that rewrites query parameters) overrides the default resolver.X‑Total‑Count and Link headers still match the capped page size by inspecting a response to a large‑size request.Could you confirm which Spring Boot and Spring Data JPA versions your JHipster project is using? That will tell us whether the spring.data.web.pageable.max-page-size property is available out of the box or if a custom resolver bean is required.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.