- Generated by
1.9.8
|
NeoGraph 0.16.0
A C++20 Graph Agent Engine Library — LangGraph for C++
|
Which Host and Origin values an A2AServer answers, and how large a request body it reads. More...
#include <server.h>
Public Attributes | |
| std::vector< std::string > | allowed_hosts |
Host header names the server answers: host names, IPv4 addresses and bracketed IPv6 addresses ([::1]), compared with the Host header's host without its port and ignoring case. | |
| std::vector< std::string > | allowed_origins |
| Exact allowed Origin values. | |
| std::size_t | max_payload_bytes = 4 * 1024 * 1024 |
| The largest request body the server reads; a larger one is answered with HTTP 413. | |
Which Host and Origin values an A2AServer answers, and how large a request body it reads.
Set with A2AServer::set_http_config() before start.
A web page on another origin can reach a server bound to a loopback address when its host name is re-pointed at this machine (DNS rebinding): the browser then sends that name in Host, and the page's own origin in Origin when it sends one. The checks cover every route of the server (the agent card, the JSON-RPC endpoint and its event streams, and any path it does not serve) and run before a request body is read. A refused request gets HTTP 403, or 400 for a missing or malformed Host.
| std::vector<std::string> neograph::a2a::A2AHttpConfig::allowed_hosts |
Host header names the server answers: host names, IPv4 addresses and bracketed IPv6 addresses ([::1]), compared with the Host header's host without its port and ignoring case.
* admits any Host. A loopback bind (127.0.0.1, ::1, localhost) always admits localhost, 127.0.0.1 and [::1] and refuses every other Host unless it is listed, with or without an Origin. On a remote bind an empty list checks nothing, and a non-empty one admits only the listed names. Behind a reverse proxy or a tunnel that forwards the public Host to a loopback server, list that name (or *).
| std::vector<std::string> neograph::a2a::A2AHttpConfig::allowed_origins |
Exact allowed Origin values.
An Origin header is rejected unless listed, except that a loopback bind also admits its own loopback origin: http://localhost:<port>, http://127.0.0.1:<port> or http://[::1]:<port> at the port it is bound to (and writes a line to stderr the first time it admits each one). A request without an Origin header is not checked.
| std::size_t neograph::a2a::A2AHttpConfig::max_payload_bytes = 4 * 1024 * 1024 |
The largest request body the server reads; a larger one is answered with HTTP 413.
The default, 4 MiB, fits the largest request an agent legitimately receives: a message whose parts carry long text or one inline file (base64 makes it a third larger than the file, so a file of a little under 3 MiB). A larger file travels as a uri part. A task keeps the messages it received in its history, and the server keeps up to 1024 tasks, so the cap also bounds what one request can add to memory; the HTTP library's own default is 100 MiB.
1.9.8