Can IIS be set up to block API Responses over a certain limit?

Question

We have an application that acts as an API Gateway, taking calls and routing them through to other APIs and then relaying the responses.

In our set up, we make sure that developers making API calls don't try and flood us by uploading massive files or sending in excessive JSON payloads. We're now trying to figure out how we make sure that we don't flood them in return if they make an API call that returns too much data.

Is there a way to set up either IIS or an ASP.Net app to refuses API responses over a certain size in the same way that we would refuse an API Request over a certain size?

Just to add an example in clear terms:

If a developer makes an API request to get all of their customers, the API Gateway passes that request to our internal Customers API. If the Customers API responds with a 600MB response, we want to block the response at the API Gateway and then we'll send a response to the developer asking them to change their request to reduce the resultset.

Answer 1

The response has not limit the size. We can limit the response size by add more parameter Content-Length into the response header.

to set Request limit you could set in web.config file:

    <system.web>
<httpRuntime maxRequestLength="2147483647" />

or

 <system.webServer>
  <security>
    <requestFiltering>
      <requestLimits maxAllowedContentLength="2147483648" />
    </requestFiltering>
  </security>
</system.webServer>

Or

You could also set below code in web.config:

<configuration> 
   <system.web.extensions>
       <scripting>
           <webServices>
               <jsonSerialization maxJsonLength="50000000"/>
           </webServices>
       </scripting>
   </system.web.extensions>
</configuration> 

maxJsonLength Configures the maximum length of the JSON string.

For more detail, you could refer: jsonSerialization Element (ASP.NET Settings Schema)

Regards, jalpa