Add MAX_PAGE_SIZE setting by TheSuperiorStanislav · Pull Request #9107 · encode/django-rest-framework

TheSuperiorStanislav · 2023-09-14T03:47:17Z

Description

Add a setting for max page size for global pagination. Our team discovered that by default, page size is unlimited which could lead to API abuse and the only way to fix it -> it's to subclass pagination class(which is a working solution, but not convenient). After investigating issues I found related issue and comment.

auvipy

I think this deserve a test case,, but as it is adding/exposing new API surface to the framework, we might need to pass the design decision step first

auvipy · 2023-09-14T14:17:52Z

OK I saw the comment now #6185 (comment) it might be possible in class level but not globally at the moment.

TheSuperiorStanislav · 2023-09-15T04:13:24Z

@auvipy I added tests for system checks, but didn't managed to find and add tests for settings with API requests like in test_pagination.py, and it's kind hard to add since pagination settings are defined as class attrs.

auvipy · 2023-10-02T12:01:26Z

we got a PR related to this area #8993. would be helpful if you review and share your views on the PR.

rest_framework/pagination.py

ankitchhatbar · 2023-12-22T08:44:08Z

@auvipy @christophehenry @TheSuperiorStanislav If you don't mind, I can take this up and implement the changes requested

Co-authored-by: Roman Gorbil <roman.gorbil@saritasa.com>

TheSuperiorStanislav · 2024-08-21T02:07:06Z

@auvipy @christophehenry Could you please take a look? Sorry for taking that long, btw 🥲

christophehenry · 2024-08-21T07:23:21Z

rest_framework/pagination.py

+    def page_size(self) -> int:
+        """Get default page size.
+
+        Defaults to `None`, meaning pagination is disabled.
+
+        """


There shoud probably be a comment explaining why this i a property to avoid removing it in a future refactor?

christophehenry · 2024-08-21T07:23:44Z

Looks good to me. Thank you.

TheSuperiorStanislav · 2024-09-19T04:19:36Z

@auvipy Could you take a look, please? This pr has been here for a while)

lovelydinosaur · 2024-09-19T10:43:40Z

rest_framework/pagination.py

    limit_query_description = _('Number of results to return per page.')
    offset_query_param = 'offset'
    offset_query_description = _('The initial index from which to return the results.')
-    max_limit = None


Can we avoid changing the style here?

max_limit = api_settings.MAX_PAGE_SIZE

Perfer minimal impact footprints for PRs.

It's related to #8993 and #9107 (comment). Without it we can't properly test it, since this setting will be set during init.

Hrm... not sure? If you'd like to take that approach then I'd probably suggest handling #8993 separately, as a precursor to this.
Unclear to me why that'd be different to attributes we use in other cases.

stale · 2025-04-26T19:30:33Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

deepakangadi · 2025-07-21T12:34:05Z

2000 lines and 80 chars per line.

Copilot

Pull request overview

Adds a global MAX_PAGE_SIZE REST framework setting to cap client-requested pagination sizes (avoiding unbounded page sizes without requiring custom pagination subclasses), and integrates it into built-in pagination classes, with docs and tests updates.

Changes:

Add MAX_PAGE_SIZE to REST_FRAMEWORK default settings and extend the pagination system check to account for it.
Read MAX_PAGE_SIZE from api_settings in built-in paginators (PageNumber/LimitOffset/Cursor) via new properties.
Add/extend tests and documentation to cover the new setting and warning behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
`rest_framework/settings.py`	Introduces `MAX_PAGE_SIZE` default setting.
`rest_framework/pagination.py`	Wires `MAX_PAGE_SIZE` into pagination implementations via settings-backed properties.
`rest_framework/checks.py`	Updates the pagination system check to warn when `MAX_PAGE_SIZE` is set without a default pagination class.
`tests/test_settings.py`	Extends system-check integration test to include `MAX_PAGE_SIZE`.
`tests/test_pagination.py`	Adds integration tests validating settings-based max page size behavior.
`docs/api-guide/pagination.md`	Documents global configuration including `MAX_PAGE_SIZE`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-02T14:37:35Z

rest_framework/pagination.py

    def paginate_queryset(self, queryset, request, view=None):
        self.request = request
        self.page_size = self.get_page_size(request)


CursorPagination.page_size is now a read-only @Property, but paginate_queryset() assigns to self.page_size. That assignment will raise AttributeError at runtime. Consider either keeping page_size as a regular attribute, or adding a setter/backing attribute so paginate_queryset can cache the computed per-request page size safely.

Copilot · 2026-04-02T14:37:35Z

rest_framework/pagination.py

    invalid_page_message = _('Invalid page.')

+    @property
+    def page_size(self) -> int:


The return type annotation here should allow None. api_settings.PAGE_SIZE defaults to None (pagination disabled), so annotating this as int is inaccurate and can confuse type checkers; consider using Optional[int]/int | None (or dropping the annotation to match the rest of the module).

Copilot · 2026-04-02T14:37:35Z

rest_framework/pagination.py

+        return api_settings.PAGE_SIZE
+
+    @property
+    def max_page_size(self) -> int:


Same type issue as page_size: api_settings.MAX_PAGE_SIZE defaults to None, so this property's return type should be Optional[int]/int | None rather than int (or omit the annotation for consistency).

Copilot · 2026-04-02T14:37:36Z

rest_framework/pagination.py

+        Set to an integer to limit the maximum page size the client may request.
+        Only relevant if 'page_size_query_param' has also been set.
+        Defaults to `None`, meaning page size is unlimited.
+        It's recommended that you would set a limit to avoid api abuse.


Docstring grammar/casing: “It's recommended that you would…” is ungrammatical, and “api” should be “API”. Consider rephrasing to “It's recommended that you set a limit to avoid API abuse.”

Suggested change

It's recommended that you would set a limit to avoid api abuse.

It's recommended that you set a limit to avoid API abuse.

Copilot · 2026-04-02T14:37:36Z

rest_framework/pagination.py

+        Set to an integer to limit the maximum page size the client may request.
+        Only relevant if 'page_size_query_param' has also been set.
+        Defaults to `None`, meaning page size is unlimited.
+        It's recommended that you would set a limit to avoid api abuse.


LimitOffsetPagination uses limit_query_param, not page_size_query_param, so this docstring is misleading. Also the same grammar/casing issue applies (“API abuse”). Update the text to refer to limit_query_param (and/or max_limit) and fix the wording.

Suggested change

Set to an integer to limit the maximum page size the client may request.

Only relevant if 'page_size_query_param' has also been set.

Defaults to `None`, meaning page size is unlimited.

It's recommended that you would set a limit to avoid api abuse.

Set to an integer to limit the maximum number of results the client may

request via the ``limit_query_param``.

Defaults to ``None``, meaning the limit is unrestricted.

It is recommended that you set a limit to avoid API abuse.

Copilot · 2026-04-02T14:37:37Z

docs/api-guide/pagination.md

+Note that you need to set both the pagination class, and the page size and limit that should be used.
+`DEFAULT_PAGINATION_CLASS`, `PAGE_SIZE`, `MAX_PAGE_SIZE` are `None` by default.


This note is a bit too strong/inaccurate: you don’t always need to set both PAGE_SIZE and MAX_PAGE_SIZE for pagination to work (e.g., LimitOffsetPagination can rely on the client-provided limit, and MAX_PAGE_SIZE only matters when a client-controllable size param is enabled). Consider rewording to clarify which settings are required vs optional depending on the pagination class.

Copilot · 2026-04-02T14:37:37Z

tests/test_pagination.py

+    @override_settings(
+        REST_FRAMEWORK={
+            "MAX_PAGE_SIZE": 20,
+            "PAGE_SIZE": 5,
+        }
+    )


This test block switches to double quotes for strings (e.g., REST_FRAMEWORK keys and response.data indexing) while the surrounding tests in this module predominantly use single quotes. Consider using the existing quote style here for consistency and to reduce diff noise.

Copilot · 2026-04-02T14:37:37Z

rest_framework/pagination.py

+        return api_settings.PAGE_SIZE
+
+    @property
+    def max_page_size(self) -> int:


These settings-backed properties can return None (MAX_PAGE_SIZE defaults to None), but the return annotation is int. Consider changing to Optional[int]/int | None (or removing the annotation) to avoid misleading type information.

Copilot · 2026-04-02T14:37:38Z

rest_framework/pagination.py

    template = 'rest_framework/pagination/numbers.html'

+    @property
+    def max_limit(self) -> int:


Same typing concern as elsewhere: api_settings.MAX_PAGE_SIZE (and PAGE_SIZE) default to None, so annotating these as int is inaccurate. Adjust the annotations to allow None or omit them for consistency with the rest of the module.

Copilot · 2026-04-02T14:37:38Z

rest_framework/pagination.py

+        It's recommended that you would set a limit to avoid api abuse.
+
+        """
+        return api_settings.MAX_PAGE_SIZE


MAX_PAGE_SIZE is now wired into LimitOffsetPagination via max_limit (and also into CursorPagination/PageNumberPagination). There are new integration tests for PageNumberPagination settings, but no corresponding tests that MAX_PAGE_SIZE actually caps limit for LimitOffsetPagination (and/or caps cursor page size when enabled). Adding a couple of targeted tests would help prevent regressions across pagination styles.

auvipy self-requested a review September 14, 2023 14:11

auvipy requested changes Sep 14, 2023

View reviewed changes

auvipy added this to the 3.15 milestone Sep 14, 2023

TheSuperiorStanislav requested a review from auvipy September 15, 2023 04:16

auvipy requested a review from a team September 19, 2023 07:44

auvipy mentioned this pull request Oct 2, 2023

Allow REST_FRAMEWORK.PAGE_SIZE to be overriden in settings #8993

Closed

christophehenry reviewed Oct 9, 2023

View reviewed changes

rest_framework/pagination.py Outdated Show resolved Hide resolved

christophehenry reviewed Oct 9, 2023

View reviewed changes

rest_framework/pagination.py Outdated Show resolved Hide resolved

christophehenry reviewed Oct 9, 2023

View reviewed changes

rest_framework/pagination.py Outdated Show resolved Hide resolved

TheSuperiorStanislav and others added 4 commits August 21, 2024 08:16

Add MAX_PAGE_SIZE setting

a9d25af

Update check for pagination settings, update test

1ada7c7

Fix setting typo

91695fb

Co-authored-by: Roman Gorbil <roman.gorbil@saritasa.com>

Move page settings to property

b51141c

TheSuperiorStanislav force-pushed the add-max-page-setting-for-pagination branch from 456a1fe to b51141c Compare August 21, 2024 02:02

TheSuperiorStanislav requested a review from christophehenry August 21, 2024 02:06

christophehenry reviewed Aug 21, 2024

View reviewed changes

christophehenry approved these changes Aug 21, 2024

View reviewed changes

Merge branch 'encode:master' into add-max-page-setting-for-pagination

6250dc0

lovelydinosaur reviewed Sep 19, 2024

View reviewed changes

TheSuperiorStanislav requested a review from lovelydinosaur September 20, 2024 06:39

stale bot added the stale label Apr 26, 2025

browniebroke removed this from the 3.15 milestone Jul 6, 2025

stale bot removed the stale label Jul 6, 2025

auvipy requested review from Copilot April 2, 2026 14:29

Merge branch 'main' into add-max-page-setting-for-pagination

0b1a070

Copilot started reviewing on behalf of auvipy April 2, 2026 14:30 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

	It's recommended that you would set a limit to avoid api abuse.
	It's recommended that you set a limit to avoid API abuse.

		Note that you need to set both the pagination class, and the page size and limit that should be used.
		`DEFAULT_PAGINATION_CLASS`, `PAGE_SIZE`, `MAX_PAGE_SIZE` are `None` by default.

Uh oh!

Conversation

TheSuperiorStanislav commented Sep 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Uh oh!

auvipy left a comment

Choose a reason for hiding this comment

Uh oh!

auvipy commented Sep 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TheSuperiorStanislav commented Sep 15, 2023

Uh oh!

auvipy commented Oct 2, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ankitchhatbar commented Dec 22, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TheSuperiorStanislav commented Aug 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

christophehenry Aug 21, 2024

Choose a reason for hiding this comment

Uh oh!

christophehenry commented Aug 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

TheSuperiorStanislav commented Sep 19, 2024

Uh oh!

lovelydinosaur Sep 19, 2024

Choose a reason for hiding this comment

Uh oh!

TheSuperiorStanislav Sep 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lovelydinosaur Sep 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stale bot commented Apr 26, 2025

Uh oh!

deepakangadi commented Jul 21, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

TheSuperiorStanislav commented Sep 14, 2023 •

edited

Loading

auvipy commented Sep 14, 2023 •

edited

Loading

ankitchhatbar commented Dec 22, 2023 •

edited

Loading

TheSuperiorStanislav commented Aug 21, 2024 •

edited

Loading

christophehenry commented Aug 21, 2024 •

edited

Loading

TheSuperiorStanislav Sep 20, 2024 •

edited

Loading

lovelydinosaur Sep 20, 2024 •

edited

Loading