express-restify-mongoose icon indicating copy to clipboard operation
express-restify-mongoose copied to clipboard

Added the ability to set totalCountHeader on a specific request

Open ericglasser opened this issue 7 years ago • 2 comments

The point of this is to be able to set totalCountHeader on specific requests. We have been dealing with larger collections where some of the queries count is not performant, and do not want it to run on.

ericglasser avatar Mar 14 '17 23:03 ericglasser

I'll take a closer look as soon as possible, thanks for your contribution!

Zertz avatar Jun 13 '17 11:06 Zertz

While this solution solves your issue on the surface, a malicious client could simply remove the query parameter, notice the difference in response time and then you're back to square one: vulnerable to DoS. I do like the idea but I think step one would be to add the ability to set the count header per endpoint and then expose a way to set it dynamically on the server, probably somewhere in pre middleware.

Zertz avatar Oct 07 '17 17:10 Zertz