There is no way to protect the application from the oversized response

[mazurkin]

the case

let's assume AsyncHttpClient reads https://example.com/robots.txt and at some moment the owner of example.com binds the dynamic controller on /robots.txt which streams the endless stream of random bytes.

problem

I do not see any way to protect the application from this attack, it will die from OOM.
The all "size" setters are not relevant if the goal is to limit the maximum response size, right? Also the org.asynchttpclient.netty.NettyResponse#getResponseBodyAsStream method is just a wrapper around the internal byte array, so it cannot be used either.

solution

In the plain Netty I used to use some "aggregation buffer size" in HttpHandler or something like that, would be nice to have some similar setting here. If the response exceeds the specified maximum size an exception is raised.