Pagination limits enforced

List endpoints without pagination caps are resource exhaustion vectors and data exfiltration shortcuts. OWASP API Security Top 10 2023 API4 (Unrestricted Resource Consumption) and CWE-400 (Uncontrolled Resource Consumption) both target this pattern. A single request for ?limit=1000000 can trigger a full table scan, exhaust database memory, and return megabytes of records in a single response. Beyond DoS, unbounded pagination is a data exfiltration technique: a single API call retrieves every user record, every order, or every payment transaction. Even authenticated users should be limited to reasonable page sizes — trust boundaries apply to consumption, not just access.

Clamp the limit parameter server-side — never trust the client-supplied value directly. Apply the cap in the data access layer, not just the route handler, so it can't be bypassed by callers that go around the API.

// src/lib/db/posts.ts
const MAX_PAGE_SIZE = 100
const DEFAULT_PAGE_SIZE = 20

export async function listPosts({ limit = DEFAULT_PAGE_SIZE, cursor }: PaginationArgs) {
  const take = Math.min(Math.max(1, limit), MAX_PAGE_SIZE)  // clamp: [1, 100]

  return db.post.findMany({
    take,
    skip: cursor ? 1 : 0,
    cursor: cursor ? { id: cursor } : undefined,
    orderBy: { createdAt: 'desc' }
  })
}

Return the applied limit and nextCursor in responses so clients know the actual window size.