Request protection starts before model binding

What the public implementation shows

Government Payments includes RequestProtectionMiddleware for body size and SecurityHeadersMiddleware for nosniff, frame denial, referrer, and cross-domain policy.

Protection runs in the HTTP pipeline before endpoint logic and domain processing. This is the implementation fact behind the note; the architectural reading begins from that visible boundary rather than from an assumed production story.

Operating principleThe cheapest safe rejection should occur at the earliest reliable boundary.

The decision behind the mechanism

Early enforcement gives every API group a consistent baseline without duplicating checks inside handlers.

Oversized payloads can consume memory or parser time before endpoint validation, and inconsistent headers leave avoidable browser interpretation risk. The mechanism matters because it gives that failure a named boundary, durable evidence, and a controlled response instead of leaving the outcome to timing or operator guesswork.

• Set a documented maximum request body size.
• Return 413 before model binding.
• Apply baseline headers to success and error responses.
• Test just-below and just-above limit behavior.

How the control should be operated

Limits should reflect the largest legitimate ISO adapter and authority payload, be tested at boundaries, and produce a predictable error contract.

The gateway rejects abusive or accidental payloads before they compete with financial work. The reusable lesson is not to copy a class or endpoint in isolation, but to preserve the relationship between identity, state, authority, evidence, and operational ownership.