Class ProxyResourceLimits

Immutable, validated snapshot of the resource bounds a peer can make the proxy allocate: header shape, body/decompression budgets, concurrency and abuse-rate ceilings, and pool / certificate-cache sizing. Constructed only through Create(long, int, long, long?, long?, double?, int?, int, int?, int, TimeSpan, bool, int, int?), which validates every field up front, so an invalid limit is a construction-time exception rather than a runtime surprise discovered mid-connection.

A limit that can legitimately be turned off is typed as nullable with null meaning "disabled" - an explicit state - rather than overloading 0 or a negative number to mean the same thing. Limits that must always be enforced because disabling them would leave the proxy itself exploitable (the concurrent-stream cap, the open-header-block frame bound) are non-nullable and always validated to be strictly positive.

This type has no back-reference to ProxyServer and no mutable state after construction: it is meant to be handed down to subsystems by value, not looked up through a service locator or an ambient static, so the dependency graph among consumers stays acyclic per the plan's "Constraints on the policy layer" section.

Inheritance

object

ProxyResourceLimits

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Namespace: Titanium.Web.Proxy.Options

Assembly: Titanium.Web.Proxy.dll

Syntax

public sealed class ProxyResourceLimits

Properties

ConnectionPoolingEnabled

Whether upstream TCP connection pooling is enabled. Disabling pooling is an explicit choice represented by this flag, not by giving MaxCachedConnectionsPerHost a sentinel value that also has to be validated as "not zero, not negative, unless it means disabled".

Declaration

public bool ConnectionPoolingEnabled { get; }

Property Value

Type	Description
bool

Default

Today's shipped values, carried forward as the Balanced profile's starting point per the plan's rollout section: this is not a behavior change for existing traffic. Limits newly introduced by the hardening plan (header aggregate bytes, decompression ratio, CONTINUATION frame count, reset budget, admission cap) are set high enough that no browser-generated traffic should reach them; they are expected to move once the benchmark project has real numbers behind them.

MaxCertificateCacheEntries is the one deliberate exception to "unchanged for existing traffic": measurement showed process memory holding steady at ~100 MB above baseline after closing every browser tab and idling for minutes, tracking the number of distinct MITM'd hosts rather than any live connection or session count. Unbounded in-memory certificate retention is a defect, not a compatibility guarantee, so the shipped default now bounds it at 1024 entries (roughly 10 MB, comfortably above real single-session browsing) rather than leaving it unbounded like every other nullable limit here defaults to.

Declaration

public static ProxyResourceLimits Default { get; }

Property Value

Type	Description
ProxyResourceLimits

MaxCachedConnectionsPerHost

Maximum pooled connections cached per remote host. Only meaningful when ConnectionPoolingEnabled is true; always validated as strictly positive regardless, so a future caller cannot re-introduce the "0 spins forever holding the pool lock" defect by flipping the flag without also fixing this value.

Declaration

public int MaxCachedConnectionsPerHost { get; }

Property Value

Type	Description
int

MaxCertificateCacheEntries

Maximum number of generated leaf certificates held in the in-memory certificate cache. Each entry holds a full X509Certificate2 with its private key, so unlike most other limits in this type this one defends against unbounded memory growth from ordinary browsing (many distinct MITM'd hosts), not just against an adversarial peer. null disables the bound and is not the shipped default - see Default.

Declaration

public int? MaxCertificateCacheEntries { get; }

Property Value

Type	Description
int?

MaxCertificateDiskCacheEntries

Maximum number of generated leaf certificate files retained in the on-disk cache (Certificates.CertificateManager.SaveFakeCertificates), pruned independently of MaxCertificateCacheEntries. Disk is far cheaper than the in-memory cache's live X509Certificate2 handles, and a warm disk cache avoids repeating expensive certificate generation across process restarts, so this bound is deliberately independent and typically much larger (or unbounded). null disables the bound.

Declaration

public int? MaxCertificateDiskCacheEntries { get; }

Property Value

Type	Description
int?

MaxConcurrentClients

Maximum number of concurrently admitted client connections, checked by the admission gate at handler entry/exit rather than the delayed ClientConnectionCount. null disables global admission control.

Declaration

public int? MaxConcurrentClients { get; }

Property Value

Type	Description
int?

MaxConcurrentStreamsPerConnection

Proxy-owned cap on concurrent HTTP/2 streams per connection. Always enforced: this is the single source of truth consolidating what were previously two independent mechanisms, and is also the value advertised to the origin in the relayed SETTINGS frame so the advertised and enforced values never disagree.

Declaration

public int MaxConcurrentStreamsPerConnection { get; }

Property Value

Type	Description
int

MaxDecodedBodyBytes

Maximum cumulative decompressed body bytes produced for a single request or response. null disables the budget. Always checked alongside MaxDecompressionRatio, since a ratio alone cannot bound total memory for a small compressed input that expands enormously without also capping the output side.

Declaration

public long? MaxDecodedBodyBytes { get; }

Property Value

Type	Description
long?

MaxDecompressionRatio

Maximum allowed ratio of decompressed to compressed bytes. null disables the ratio check (relying on MaxDecodedBodyBytes alone).

Declaration

public double? MaxDecompressionRatio { get; }

Property Value

Type	Description
double?

MaxEncodedBodyBytes

Maximum cumulative compressed/on-wire body bytes read for a single request or response. null disables the budget.

Declaration

public long? MaxEncodedBodyBytes { get; }

Property Value

Type	Description
long?

MaxHeaderAggregateBytes

Maximum aggregate size of all header fields in one request or response, in bytes.

Declaration

public long MaxHeaderAggregateBytes { get; }

Property Value

Type	Description
long

MaxHeaderCount

Maximum number of header fields accepted in one request or response.

Declaration

public int MaxHeaderCount { get; }

Property Value

Type	Description
int

MaxHeaderLineBytes

Maximum length of a single header line (request/status line or one header field), in bytes.

Declaration

public long MaxHeaderLineBytes { get; }

Property Value

Type	Description
long

MaxOpenHeaderBlockDuration

Maximum wall-clock duration an HTTP/2 header block may stay open (from the initial HEADERS/PUSH_PROMISE frame sent without END_HEADERS through its terminating CONTINUATION), independent of MaxOpenHeaderBlockFrames. Bounds a slow CONTINUATION-trickle variant that stays under the frame-count cap by pacing itself, which a frame-count-only bound cannot catch on its own. Always enforced.

Declaration

public TimeSpan MaxOpenHeaderBlockDuration { get; }

Property Value

Type	Description
TimeSpan

MaxOpenHeaderBlockFrames

Maximum number of CONTINUATION frames tolerated for a single open HTTP/2 header block, independent of the existing byte cap. Always enforced: zero-length CONTINUATION frames never trip a byte-based check, and only one header block may be open per connection direction, so an unbounded frame count also head-of-line blocks every other stream.

Declaration

public int MaxOpenHeaderBlockFrames { get; }

Property Value

Type	Description
int

MaxOriginHttp2ConnectionsPerAuthority

Maximum number of concurrent origin HTTP/2 connections the proxy may open for one authority (host+port+scheme) when multiplexing streams from a single client connection (SocketsHttpHandler EnableMultipleHttp2Connections analog). Always at least 1.

Declaration

public int MaxOriginHttp2ConnectionsPerAuthority { get; }

Property Value

Type	Description
int

MaxPeerInitiatedIncompleteStreamResets

Maximum number of peer-initiated resets of streams that never completed, per connection, before the proxy tears the connection down. Proxy-initiated resets (e.g. in response to a client cancellation) do not count. null disables the reset budget.

Declaration

public int? MaxPeerInitiatedIncompleteStreamResets { get; }

Property Value

Type	Description
int?

Methods

Create(long, int, long, long?, long?, double?, int?, int, int?, int, TimeSpan, bool, int, int?)

Validates and constructs a ProxyResourceLimits snapshot. Every non-nullable bound must be strictly positive; every nullable bound, if supplied, must also be strictly positive (use null to disable rather than a sentinel number).

Declaration

public static ProxyResourceLimits Create(long maxHeaderLineBytes, int maxHeaderCount, long maxHeaderAggregateBytes, long? maxEncodedBodyBytes, long? maxDecodedBodyBytes, double? maxDecompressionRatio, int? maxConcurrentClients, int maxConcurrentStreamsPerConnection, int? maxPeerInitiatedIncompleteStreamResets, int maxOpenHeaderBlockFrames, TimeSpan maxOpenHeaderBlockDuration, bool connectionPoolingEnabled, int maxCachedConnectionsPerHost, int? maxCertificateCacheEntries)

Parameters

Type	Name	Description
long	maxHeaderLineBytes
int	maxHeaderCount
long	maxHeaderAggregateBytes
long?	maxEncodedBodyBytes
long?	maxDecodedBodyBytes
double?	maxDecompressionRatio
int?	maxConcurrentClients
int	maxConcurrentStreamsPerConnection
int?	maxPeerInitiatedIncompleteStreamResets
int	maxOpenHeaderBlockFrames
TimeSpan	maxOpenHeaderBlockDuration
bool	connectionPoolingEnabled
int	maxCachedConnectionsPerHost
int?	maxCertificateCacheEntries

Returns

Type	Description
ProxyResourceLimits

Exceptions

Type	Condition
ArgumentOutOfRangeException	A supplied value is zero or negative.

WithCertificateCacheBounds(int?, int?)

Returns a copy of this instance with MaxCertificateCacheEntries and MaxCertificateDiskCacheEntries replaced, leaving every other limit unchanged. Added instead of extending Create(long, int, long, long?, long?, double?, int?, int, int?, int, TimeSpan, bool, int, int?) - which is public API already shipped with a fixed parameter list - so that adding the independent disk-cache bound could not be a breaking change for existing callers.

Declaration

public ProxyResourceLimits WithCertificateCacheBounds(int? maxCertificateCacheEntries, int? maxCertificateDiskCacheEntries)

Parameters

Type	Name	Description
int?	maxCertificateCacheEntries	See MaxCertificateCacheEntries. null disables the bound.
int?	maxCertificateDiskCacheEntries	See MaxCertificateDiskCacheEntries. null disables the bound.

Returns

Type	Description
ProxyResourceLimits

Exceptions

Type	Condition
ArgumentOutOfRangeException	A supplied value is zero or negative.

WithMaxOriginHttp2ConnectionsPerAuthority(int)

Returns a copy with MaxOriginHttp2ConnectionsPerAuthority replaced.

Declaration

public ProxyResourceLimits WithMaxOriginHttp2ConnectionsPerAuthority(int maxOriginHttp2ConnectionsPerAuthority)

Parameters

Type	Name	Description
int	maxOriginHttp2ConnectionsPerAuthority

Returns

Type	Description
ProxyResourceLimits