Re: Error behaviour for max_input_vars

Hi On 9/13/22 19:58, Mel Dafert wrote:

- Deciding that max_input_vars is not relevant anymore and should be handled by the likes of Apache and NGINX, thus changing the default to 0 and removing the setting

      over a deprecation period.

This would be my preferred option, but my understanding is that the limit still is relevant to protect against attacks on the hash table implementation. The web server can't really protect against this type of attack, because the payload required to execute the attack is fairly small. Protecting against the attack without some arbitrary cut-off limit would require making the hash algorithm used for the superglobals dependent on a randomly generated per-request seed value. I can't comment on how easy or hard that would be to change, but I believe that this should be the ultimate goal here. It's also what other programming languages do. Best regards Tim Düsterhus