Enum PolicyFamily

The resource-bound policy families that support an PolicyMode other than Enforce, per the plan's rollout section. Framing, chunk parsing and Content-Length/Transfer-Encoding resolution are deliberately not members of this enum: they are always enforced and never consult a mode, because there is no safe Observe action for an ambiguous or malformed message - see ProxyPolicyModes and AllowAmbiguousFraming for the one explicit, isolated escape hatch from that rule.

Namespace: Titanium.Web.Proxy.Options

Assembly: Titanium.Web.Proxy.dll

Syntax

public enum PolicyFamily

Fields

Name	Description
AdmissionControl	The global and per-endpoint admission gates that bound concurrently admitted client connections.
BodyBudget	Cumulative whole-body buffering limits (MaxBufferedBodyBytes) enforced via Titanium.Web.Proxy.Network.Streams.BoundedWriteStream when a caller materializes a body. Streaming relays do not consult this family. MaxEncodedBodyBytes and MaxDecodedBodyBytes are reserved. They are accepted by option plumbing and are not enforced on a live read path; the enforced whole-body budget is MaxBufferedBodyBytes.
DecompressionRatio	The compressed-input/decompressed-output byte budgets and the expansion-ratio ceiling (MaxDecompressionRatio) applied while draining a Content-Encoding chain, so a small compressed body cannot expand unboundedly in memory before BodyBudget's own decoded-byte cap would catch it. Today, that decoded-byte cap is exactly what protects this case in practice: the decompression chain writes into the same Titanium.Web.Proxy.Network.Streams.BoundedWriteStream- wrapped target BodyBudget already bounds, so a small compressed body that expands enormously is caught the moment the decoded output crosses that limit, without needing a separately computed ratio. MaxDecompressionRatio and the encoded/decoded byte pair remain reserved for a future, more precise per-stream computation; this family's mode exists now so a profile can name it, but changing it has no additional effect while BodyBudget already covers the same paths.
HeaderLimits	Header line length, header count and aggregate header-byte limits (MaxHeaderLineBytes/MaxHeaderCount/ MaxHeaderAggregateBytes) intended for the request/response header-block read. Reserved, like DecompressionRatio, for numeric enforcement not yet wired to every header-reading call site; this family's mode exists so a profile can name it ahead of that work landing. The client request-line/header deadline (a different, already-enforced protection - see ProxyServer.ClientHeaderTimeoutSeconds and DeadlineRegistry) is unaffected by this family's mode.
Http1ReplaySafety	Whether HTTP/1 keep-alive retries (EOF-before-response, malformed status, mid-exchange IOException) and bare CR in header values follow the strict replay-safe rules. Observe (default on Balanced and LegacyCompatible) keeps today's lenient behavior and records a policy breach metric when the strict rule would have fired. Enforce (default on PublicFacing) refuses to replay non-idempotent methods and rejects bare CR/LF/NUL in header values.
Http2AbuseBudget	HTTP/2 abuse budgets: the open-header-block CONTINUATION frame-count/wall-clock bound and the peer-initiated incomplete-stream-reset budget.
Http2RelayValidation	Whether HPACK header blocks on the H2↔H2 compressed-relay path (httpInterceptionEnabled = false) are semantically validated per RFC 9113 §8.3. Unlike framing (always enforced, no Observe action), header semantics can be logged without corrupting connection state. Disabled (default on Balanced) skips HPACK decode entirely — maximum throughput when upstream peers are trusted. Observe decodes and records semantic violations without rejecting the stream. Does not mutate headers, so the compressed-relay MutationCount fast path is unaffected when the family is Disabled. Enforce (default on PublicFacing and AllEnforce) decodes and sends GOAWAY(PROTOCOL_ERROR) on violations.
WebSocketFrameBudget	Per-frame WebSocket payload limit (MaxWebSocketFramePayloadBytes) applied only when BeforeWebSocketFrame is subscribed. Raw relay is unaffected. Enforce (default on every profile) closes the connection with status 1009 before the payload is buffered. Observe relays an oversize frame without materializing it and raises SessionEventArgs.WebSocketFrameElided. Frame hooks are not invoked for that payload, so a content filter must stay on Enforce. Disabled skips the check and will buffer the frame, up to the decoder's structural MaxValue bound.