Allow configuring JSON request body size limits

[alxndrsn]

No description provided.

[louwers]

Sounds problematic from a security standpoint.

https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#set-request-size-limits

[alxndrsn]

@louwers would it be less of a concern if this value was configurable, and defaulted to the current 1mb?

As a comparison, couchdb's default is 4GB: https://docs.couchdb.org/en/stable/config/http.html#chttpd/max_http_request_size

Because of this lib's use in the pouchdb test suite, the current limit means that pouchdb tests can't make requests larger than 1MB.

[louwers]

Yes being configurable will help (keep the default low, allow people to override when they understand the security implications).

There is a whole discussion on the CouchDB side about this as well. I think it is even more of an attack vector for Node.js since it is single-threaded.

apache/couchdb#1253

Because of this lib's use in the pouchdb test suite, the current limit means that pouchdb tests can't make requests larger than 1MB.

Make sense!

[alxndrsn]

@louwers thanks for the suggestions; PR updated