Class ProxyResourceLimits

Immutable, validated snapshot of the resource bounds a peer can make the proxy allocate: header shape, body/decompression budgets, concurrency and abuse-rate ceilings, and pool / certificate-cache sizing. Constructed only through Create(long, int, long, long?, long?, double?, int?, int, int?, int, TimeSpan, bool, int, int?), which validates every field up front, so an invalid limit is a construction-time exception rather than a runtime surprise discovered mid-connection.

A limit that can legitimately be turned off is typed as nullable with null meaning "disabled" - an explicit state - rather than overloading 0 or a negative number to mean the same thing. Limits that must always be enforced because disabling them would leave the proxy itself exploitable (the concurrent-stream cap, the open-header-block frame bound) are non-nullable and always validated to be strictly positive.

This type has no back-reference to ProxyServer and no mutable state after construction: it is meant to be handed down to subsystems by value, not looked up through a service locator or an ambient static, so the dependency graph among consumers stays acyclic per the plan's "Constraints on the policy layer" section.

Inheritance

object

ProxyResourceLimits

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Namespace: Titanium.Web.Proxy.Options

Assembly: Titanium.Web.Proxy.dll

Syntax

public sealed class ProxyResourceLimits

Fields

MaxDeferredOutboundBytesCeiling

Upper bound for MaxDeferredOutboundBytesPerStream.

Declaration

public const int MaxDeferredOutboundBytesCeiling = 67108864

Field Value

Type	Description
int

MaxHttp3FramePayloadCeiling

Upper bound for MaxHttp3FramePayloadBytes.

Declaration

public const long MaxHttp3FramePayloadCeiling = 67108864

Field Value

Type	Description
long

Properties

ConnectionPoolingEnabled

Whether upstream TCP connection pooling is enabled. Disabling pooling is an explicit choice represented by this flag, not by giving MaxCachedConnectionsPerHost a sentinel value that also has to be validated as "not zero, not negative, unless it means disabled".

Declaration

public bool ConnectionPoolingEnabled { get; }

Property Value

Type	Description
bool

Default

Today's shipped values, carried forward as the Balanced profile's starting point. Header, decompression, CONTINUATION, and reset budgets stay high enough that ordinary browser traffic does not trip them. MaxConcurrentStreamsPerConnection is 1000, matching Chrome's own concurrent-stream setting: 256 reset later requests on a single x.com connection (REFUSED_STREAM) while the same page succeeded with no proxy. The check runs only when a stream is opened, so traffic under the old cap takes the same DATA path. PublicFacing pins the cap back to 256.

MaxCertificateCacheEntries is the one deliberate exception to "unchanged for existing traffic": measurement showed process memory holding steady at ~100 MB above baseline after closing every browser tab and idling for minutes, tracking the number of distinct MITM'd hosts rather than any live connection or session count. Unbounded in-memory certificate retention is a defect, not a compatibility guarantee, so the shipped default now bounds it at 1024 entries (roughly 10 MB, comfortably above real single-session browsing) rather than leaving it unbounded like every other nullable limit here defaults to.

Declaration

public static ProxyResourceLimits Default { get; }

Property Value

Type	Description
ProxyResourceLimits

Http2WindowUpdateTimeoutSeconds

Seconds to wait for an HTTP/2 WINDOW_UPDATE before failing the stream. Default 60.

Declaration

public int Http2WindowUpdateTimeoutSeconds { get; }

Property Value

Type	Description
int

MaxAuthChallengeRounds

Maximum Windows/proxy authentication challenge rounds per request. Default 3.

Declaration

public int MaxAuthChallengeRounds { get; }

Property Value

Type	Description
int

MaxCachedConnectionsPerHost

Maximum pooled connections cached per remote host. Only meaningful when ConnectionPoolingEnabled is true; always validated as strictly positive regardless, so a future caller cannot re-introduce the "0 spins forever holding the pool lock" defect by flipping the flag without also fixing this value.

Declaration

public int MaxCachedConnectionsPerHost { get; }

Property Value

Type	Description
int

MaxCertificateCacheEntries

Maximum number of generated leaf certificates held in the in-memory certificate cache. Each entry holds a full X509Certificate2 with its private key, so unlike most other limits in this type this one defends against unbounded memory growth from ordinary browsing (many distinct MITM'd hosts), not just against an adversarial peer. null disables the bound and is not the shipped default - see Default.

Declaration

public int? MaxCertificateCacheEntries { get; }

Property Value

Type	Description
int?

MaxCertificateDiskCacheEntries

Maximum number of generated leaf certificate files retained in the on-disk cache (Certificates.CertificateManager.SaveFakeCertificates), pruned independently of MaxCertificateCacheEntries. Disk is far cheaper than the in-memory cache's live X509Certificate2 handles, and a warm disk cache avoids repeating expensive certificate generation across process restarts, so this bound is deliberately independent and typically much larger (or unbounded). null disables the bound.

Declaration

public int? MaxCertificateDiskCacheEntries { get; }

Property Value

Type	Description
int?

MaxConcurrentClients

Maximum number of concurrently admitted client connections, checked by the admission gate at handler entry/exit rather than the delayed ClientConnectionCount. null disables global admission control.

Declaration

public int? MaxConcurrentClients { get; }

Property Value

Type	Description
int?

MaxConcurrentStreamsPerConnection

Proxy-owned cap on concurrent HTTP/2 streams per connection. Always enforced: this is the single source of truth consolidating what were previously two independent mechanisms, and is also the value advertised to the origin in the relayed SETTINGS frame so the advertised and enforced values never disagree.

Declaration

public int MaxConcurrentStreamsPerConnection { get; }

Property Value

Type	Description
int

MaxDecodedBodyBytes

Maximum cumulative decompressed body bytes produced for a single request or response. null disables the budget. Always checked alongside MaxDecompressionRatio, since a ratio alone cannot bound total memory for a small compressed input that expands enormously without also capping the output side.

Declaration

public long? MaxDecodedBodyBytes { get; }

Property Value

Type	Description
long?

MaxDecompressionRatio

Maximum allowed ratio of decompressed to compressed bytes. null disables the ratio check (relying on MaxDecodedBodyBytes alone).

Declaration

public double? MaxDecompressionRatio { get; }

Property Value

Type	Description
double?

MaxDeferredOutboundBytesPerStream

Bytes of HTTP/2 DATA that may be parked per stream waiting for send-window credit. Worst-case memory is concurrent streams times this value. Default 4 MiB + 16 KiB. Ceiling 64 MiB.

Declaration

public int MaxDeferredOutboundBytesPerStream { get; }

Property Value

Type	Description
int

MaxEncodedBodyBytes

Maximum cumulative compressed/on-wire body bytes read for a single request or response. null disables the budget.

Declaration

public long? MaxEncodedBodyBytes { get; }

Property Value

Type	Description
long?

MaxHeaderAggregateBytes

Maximum aggregate size of all header fields in one request or response, in bytes.

Declaration

public long MaxHeaderAggregateBytes { get; }

Property Value

Type	Description
long

MaxHeaderCount

Maximum number of header fields accepted in one request or response.

Declaration

public int MaxHeaderCount { get; }

Property Value

Type	Description
int

MaxHeaderLineBytes

Maximum length of a single header line (request/status line or one header field), in bytes.

Declaration

public long MaxHeaderLineBytes { get; }

Property Value

Type	Description
long

MaxHttp2CompressedHeaderBlockBytes

Maximum compressed HTTP/2 header block (HEADERS + CONTINUATION) in bytes. Default 256 KiB.

Declaration

public int MaxHttp2CompressedHeaderBlockBytes { get; }

Property Value

Type	Description
int

MaxHttp3FramePayloadBytes

Maximum HTTP/3 frame payload accepted before H3_EXCESSIVE_LOAD. Default 4 MiB. Ceiling 64 MiB.

Declaration

public long MaxHttp3FramePayloadBytes { get; }

Property Value

Type	Description
long

MaxInterimResponses

Maximum interim (1xx) responses accepted from one origin before the stream fails. Default 20.

Declaration

public int MaxInterimResponses { get; }

Property Value

Type	Description
int

MaxOpenHeaderBlockDuration

Maximum wall-clock duration an HTTP/2 header block may stay open (from the initial HEADERS/PUSH_PROMISE frame sent without END_HEADERS through its terminating CONTINUATION), independent of MaxOpenHeaderBlockFrames. Bounds a slow CONTINUATION-trickle variant that stays under the frame-count cap by pacing itself, which a frame-count-only bound cannot catch on its own. Always enforced.

Declaration

public TimeSpan MaxOpenHeaderBlockDuration { get; }

Property Value

Type	Description
TimeSpan

MaxOpenHeaderBlockFrames

Maximum number of CONTINUATION frames tolerated for a single open HTTP/2 header block, independent of the existing byte cap. Always enforced: zero-length CONTINUATION frames never trip a byte-based check, and only one header block may be open per connection direction, so an unbounded frame count also head-of-line blocks every other stream.

Declaration

public int MaxOpenHeaderBlockFrames { get; }

Property Value

Type	Description
int

MaxOriginHttp2ConnectionsPerAuthority

Maximum number of concurrent origin HTTP/2 connections the proxy may open for one authority (host+port+scheme) when multiplexing streams from a single client connection (SocketsHttpHandler EnableMultipleHttp2Connections analog). Always at least 1.

Declaration

public int MaxOriginHttp2ConnectionsPerAuthority { get; }

Property Value

Type	Description
int

MaxPeerInitiatedIncompleteStreamResets

Maximum number of peer-initiated resets of streams that never completed, per connection, before the proxy tears the connection down. Proxy-initiated resets (e.g. in response to a client cancellation) do not count. null disables the reset budget.

Declaration

public int? MaxPeerInitiatedIncompleteStreamResets { get; }

Property Value

Type	Description
int?

MaxTrailerHeaderBlockBytes

Maximum trailer header block size in bytes. Default 16 KiB.

Declaration

public int MaxTrailerHeaderBlockBytes { get; }

Property Value

Type	Description
int

MaxTrailerHeaderCount

Maximum trailer header fields on one chunked message. Default 100.

Declaration

public int MaxTrailerHeaderCount { get; }

Property Value

Type	Description
int

MaxUpstreamProxyAuthenticationAttempts

Maximum CONNECT authentication attempts against an upstream proxy. Default 5.

Declaration

public int MaxUpstreamProxyAuthenticationAttempts { get; }

Property Value

Type	Description
int

MaxWinAuthTokenBytes

Maximum SSPI token buffer in bytes. Default 12288.

Declaration

public int MaxWinAuthTokenBytes { get; }

Property Value

Type	Description
int

Methods

Create(long, int, long, long?, long?, double?, int?, int, int?, int, TimeSpan, bool, int, int?)

Validates and constructs a ProxyResourceLimits snapshot. Every non-nullable bound must be strictly positive; every nullable bound, if supplied, must also be strictly positive (use null to disable rather than a sentinel number).

Declaration

public static ProxyResourceLimits Create(long maxHeaderLineBytes, int maxHeaderCount, long maxHeaderAggregateBytes, long? maxEncodedBodyBytes, long? maxDecodedBodyBytes, double? maxDecompressionRatio, int? maxConcurrentClients, int maxConcurrentStreamsPerConnection, int? maxPeerInitiatedIncompleteStreamResets, int maxOpenHeaderBlockFrames, TimeSpan maxOpenHeaderBlockDuration, bool connectionPoolingEnabled, int maxCachedConnectionsPerHost, int? maxCertificateCacheEntries)

Parameters

Type	Name	Description
long	maxHeaderLineBytes
int	maxHeaderCount
long	maxHeaderAggregateBytes
long?	maxEncodedBodyBytes
long?	maxDecodedBodyBytes
double?	maxDecompressionRatio
int?	maxConcurrentClients
int	maxConcurrentStreamsPerConnection
int?	maxPeerInitiatedIncompleteStreamResets
int	maxOpenHeaderBlockFrames
TimeSpan	maxOpenHeaderBlockDuration
bool	connectionPoolingEnabled
int	maxCachedConnectionsPerHost
int?	maxCertificateCacheEntries

Returns

Type	Description
ProxyResourceLimits

Exceptions

Type	Condition
ArgumentOutOfRangeException	A supplied value is zero or negative.

WithAuthenticationBounds(int, int, int)

Returns a copy with authentication bounds replaced.

Declaration

public ProxyResourceLimits WithAuthenticationBounds(int maxAuthChallengeRounds, int maxUpstreamProxyAuthenticationAttempts, int maxWinAuthTokenBytes)

Parameters

Type	Name	Description
int	maxAuthChallengeRounds
int	maxUpstreamProxyAuthenticationAttempts
int	maxWinAuthTokenBytes

Returns

Type	Description
ProxyResourceLimits

WithCertificateCacheBounds(int?, int?)

Returns a copy of this instance with MaxCertificateCacheEntries and MaxCertificateDiskCacheEntries replaced, leaving every other limit unchanged. Added instead of extending Create(long, int, long, long?, long?, double?, int?, int, int?, int, TimeSpan, bool, int, int?) - which is public API already shipped with a fixed parameter list - so that adding the independent disk-cache bound could not be a breaking change for existing callers.

Declaration

public ProxyResourceLimits WithCertificateCacheBounds(int? maxCertificateCacheEntries, int? maxCertificateDiskCacheEntries)

Parameters

Type	Name	Description
int?	maxCertificateCacheEntries	See MaxCertificateCacheEntries. null disables the bound.
int?	maxCertificateDiskCacheEntries	See MaxCertificateDiskCacheEntries. null disables the bound.

Returns

Type	Description
ProxyResourceLimits

Exceptions

Type	Condition
ArgumentOutOfRangeException	A supplied value is zero or negative.

WithHttp2WindowUpdateTimeoutSeconds(int)

Returns a copy with Http2WindowUpdateTimeoutSeconds replaced.

Declaration

public ProxyResourceLimits WithHttp2WindowUpdateTimeoutSeconds(int http2WindowUpdateTimeoutSeconds)

Parameters

Type	Name	Description
int	http2WindowUpdateTimeoutSeconds

Returns

Type	Description
ProxyResourceLimits

WithMaxConcurrentStreamsPerConnection(int)

Returns a copy with MaxConcurrentStreamsPerConnection replaced.

Declaration

public ProxyResourceLimits WithMaxConcurrentStreamsPerConnection(int maxConcurrentStreamsPerConnection)

Parameters

Type	Name	Description
int	maxConcurrentStreamsPerConnection

Returns

Type	Description
ProxyResourceLimits

WithMaxDeferredOutboundBytesPerStream(int)

Returns a copy with MaxDeferredOutboundBytesPerStream replaced.

Declaration

public ProxyResourceLimits WithMaxDeferredOutboundBytesPerStream(int maxDeferredOutboundBytesPerStream)

Parameters

Type	Name	Description
int	maxDeferredOutboundBytesPerStream

Returns

Type	Description
ProxyResourceLimits

WithMaxHttp2CompressedHeaderBlockBytes(int)

Returns a copy with MaxHttp2CompressedHeaderBlockBytes replaced.

Declaration

public ProxyResourceLimits WithMaxHttp2CompressedHeaderBlockBytes(int maxHttp2CompressedHeaderBlockBytes)

Parameters

Type	Name	Description
int	maxHttp2CompressedHeaderBlockBytes

Returns

Type	Description
ProxyResourceLimits

WithMaxHttp3FramePayloadBytes(long)

Returns a copy with MaxHttp3FramePayloadBytes replaced.

Declaration

public ProxyResourceLimits WithMaxHttp3FramePayloadBytes(long maxHttp3FramePayloadBytes)

Parameters

Type	Name	Description
long	maxHttp3FramePayloadBytes

Returns

Type	Description
ProxyResourceLimits

WithMaxInterimResponses(int)

Returns a copy with MaxInterimResponses replaced.

Declaration

public ProxyResourceLimits WithMaxInterimResponses(int maxInterimResponses)

Parameters

Type	Name	Description
int	maxInterimResponses

Returns

Type	Description
ProxyResourceLimits

WithMaxOriginHttp2ConnectionsPerAuthority(int)

Returns a copy with MaxOriginHttp2ConnectionsPerAuthority replaced.

Declaration

public ProxyResourceLimits WithMaxOriginHttp2ConnectionsPerAuthority(int maxOriginHttp2ConnectionsPerAuthority)

Parameters

Type	Name	Description
int	maxOriginHttp2ConnectionsPerAuthority

Returns

Type	Description
ProxyResourceLimits

WithTrailerHeaderBounds(int, int)

Returns a copy with trailer header bounds replaced.

Declaration

public ProxyResourceLimits WithTrailerHeaderBounds(int maxTrailerHeaderCount, int maxTrailerHeaderBlockBytes)

Parameters

Type	Name	Description
int	maxTrailerHeaderCount
int	maxTrailerHeaderBlockBytes

Returns

Type	Description
ProxyResourceLimits