Feature request: configuration file setting for MAX_PAGE_SIZE

[lcary]

Checklist

• I have verified that that issue exists against the master branch of Django REST framework.
• I have searched for similar issues in both open and closed tickets and cannot find a duplicate.
• This is not a usage question. (Those should be directed to the discussion group instead.)
• This cannot be dealt with as a third party library. (We prefer new functionality to be in the form of third party libraries where possible.)
• I have reduced the issue to the simplest possible case.
• I have included a failing test as a pull request. (If you are unable to do so we can still accept the issue.)

Details

This issue is intended to discuss adding a MAX_PAGE_SIZE pagination setting to the REST_FRAMEWORK settings.

The default page size for paginated results can be configured by setting PAGE_SIZE in the REST_FRAMEWORK section of the Django settings file. However, there is no setting to configure the maximum page size from the Django settings file. The django-rest-framework could benefit from having a MAX_PAGE_SIZE setting as well:

REST_FRAMEWORK = {
    'PAGE_SIZE': 10,
    'MAX_PAGE_SIZE': 1000,
    ...
}

Downstream issue: The django-rest-framework-json-api library by default sets the maximum page size to a value of 100, which can be overridden by a JsonApiPageNumberPagination class. Using a class to configure the maximum page size, and using the Django configuration file to change the default page size is unnecessarily inconsistent. It would be preferable to be able to configure both settings in one place and to have this setting supported by the django-rest-framework library and not a dependent library.

Please let me know what you think about this feature request. I'm open to alternative solutions, and also open to submitting a pull request that modifies the relevant lines of the pagination module and adds documentation for the new django-rest-framework setting.

[ralfzen]

Hi @lcary
I think there is no need the drf-json-api because you could also write your own PaginationClass like this:

from rest_framework.pagination import CursorPagination

class DefaultCursorPagination(CursorPagination):
    """
    TODO move this to settings to provide better standardization
    See http://www.django-rest-framework.org/api-guide/pagination/
    """
    page_size = 30
    max_page_size = 100
    page_size_query_param = 'page_size'

class PaginatedViewSet(viewsets.ModelViewSet):
        pagination_class = DefaultCursorPagination

But I agree any way it would be nice to have the max_page_size as a setting.

[tomchristie]

Use DEFAULT_PAGINATION_CLASS in settings, and point at a configured class.

https://www.django-rest-framework.org/api-guide/pagination/#modifying-the-pagination-style

(Tho I do notice that it appears to be missing from the settings docs)

[ralfzen]

Good point. I forgot about that. Thanks for the hint!

[Elkasitu]

@tomchristie would a contribution towards having a MAX_PAGE_SIZE setting be considered? I understand that workarounds exist but I think most people using DRF won't bother with subclassing, and it's a very important setting as it can lead to DoS attacks.

Plus, if there's already a PAGE_SIZE setting it seems only natural to have a MAX_PAGE_SIZE setting as well.

[tomchristie]

if there's already a PAGE_SIZE setting it seems only natural to have a MAX_PAGE_SIZE setting as well.

that seems reasonable

[auvipy]

if there's already a PAGE_SIZE setting it seems only natural to have a MAX_PAGE_SIZE setting as well.

that seems reasonable

Tom, I think in that case we can add this to our API surface. And I think the issue explained is true and I faced that in production too.