security: Add request body size limits to FastAPI

[YaronZaki]

Problem Statement

No request body size limits configured in FastAPI or nginx. Large payloads could cause DoS via memory exhaustion before application-level validation runs.

Evidence

• quantara/web_app/api/main.py: No maximum_request_body_size configured
• quantara/frontend/quantara.conf: No client_max_body_size directive in nginx

Impact

Medium — DoS vector. Attacker can send multi-GB JSON payloads exhausting server memory before Pydantic validation runs.

Proposed Solution

Set nginx client_max_body_size 1M (rejects at edge). Additionally configure FastAPI maximum_request_body_size as defense-in-depth.

Acceptance Criteria

• Request body capped at 1MB for API endpoints
• 413 Payload Too Large returned for oversized requests
• Nginx configured with client_max_body_size 1M
• All existing tests pass

File Map

• quantara/web_app/api/main.py — configure body size limit
• quantara/frontend/quantara.conf — add client_max_body_size 1M
• quantara/frontend/quantara_dev.conf — add client_max_body_size 1M

Testing Strategy

• Integration: Send request with body >1MB, verify 413 response

Security Considerations

DoS hardening. Nginx-level limit is most effective — rejects before reaching application.

Definition of Done

• Code implemented and peer-reviewed
• Tests written and passing
• PR linked and merged

---

Labels: security, quick-win
Priority: Medium
Difficulty: Beginner
Estimated Effort: 0.5h

[dominiccreates]

Hi, I’d like to work on this issue. I have experience building full-stack applications with Soroban, handling both smart contract logic and frontend integration, and I’m comfortable debugging and delivering clean, maintainable solutions. I focus on clear communication and incremental updates to ensure smooth collaboration. I can complete this task within 2-4hours while maintaining code quality and proper testing. Looking forward to contributing!

[samieazubike]

Hi maintainer! Kindly assign the issue to me. I can create a PR within 12hr

[grantfox-oss]

🦊 GrantFox — @dominiccreates has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #46)
2. Your PR will be reviewed by the Quantarq maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@dominiccreates's PR #147 was approved and merged by @YaronZaki.

🏆 @dominiccreates: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (308 total points). Track your full progress on GrantFox.

👏 Great work, @dominiccreates! Keep contributing to Quantarq.