Quarkus 3.33

Apply the Java 21 baseline first. These rules cover Quarkus 3.33 LTS controls.

HTTP limits and proxy trust

• Keep quarkus.http.limits.max-body-size at or below its 10 MiB default and set smaller route-specific limits before a handler buffers or parses a body.
• Bound forms with max-form-attribute-size, max-form-fields, and max-form-buffered-bytes; values of -1 disable the corresponding field-count or buffering limit.
• Bound request lines, headers, parameters, multipart headers, connections, and HTTP/2 streams; the defaults do not provide practical connection or HTTP/2 stream budgets.
• Leave quarkus.http.proxy.proxy-address-forwarding=false unless a known reverse proxy strips client-supplied forwarding headers.
• When forwarding is enabled, set quarkus.http.proxy.trusted-proxies to exact IP/CIDR ranges: an absent list trusts every proxy, and hostnames cause DNS lookups on requests.

WebSockets Next

• Secure protected WebSockets Next upgrades with @Authenticated or @RolesAllowed on the endpoint class; annotations only on callbacks leave the upgrade unprotected. Authorize each message's operation and tenant or object access separately. For browser clients, require wss and reject untrusted Origin values before upgrade, using HttpUpgradeCheck.perform() when custom checks are needed.
• Set quarkus.websockets-next.server.max-frame-size and max-message-size to application-sized byte limits. Keep serial inbound processing unless bounded application concurrency is enforced; InboundProcessingMode.CONCURRENT supplies no concurrency limit.
• On