Node executor should not send gRPC messages larger than 4MiB

Problem

It is generally considered that gRPC messages should not exceed 4MiB = 4194304 bytes. According to https://github.com/grpc/grpc-web/issues/1182 it seems that there is not necessarily a strict/consistent rule but other docs like https://learn.microsoft.com/en-us/aspnet/core/grpc/security?view=aspnetcore-9.0#message-size-limits suggest 4MiB is a limit often enforced by servers.

The Go gRPC client seems to enforce a limit of 4MiB and breaks if it exceeds this limit.

The node executor does not seem to be enforcing any limit on outgoing messages and it seems likely this is breaking some implementations (specifically our Cloudflare proxying).

We have a related problem in the Go executor at gitlab-org/duo-workflow/duo-workflow-executor#77 (closed) .

Solution

Limit payloads to a total of 4MiB. This means limiting each field in a response to be less than 4MiB. Since the response has a few fields we should probably set a limit on each field of 1MiB. In the Go executor (and possible node) our ActionResponse duplicates the same response data under legacyResponse so it will not work to simply truncate that field to 4MiB as we'll then end up sending 8MiB of data.

Also take note of how this was implemented in the Go executor in gitlab-org/duo-workflow/duo-workflow-executor!220 (merged) . The other interesting thing is that we actually have a client side limit in Go which prevents us from sending these messages larger than 4MiB. This was very helpful in actually diagnosing the problem in the first place because it meant we see the exact exception right away rather than a confusing disconnect from the proxy without explanation. We should do the same in the node client.