Limit items per page in Django REST Framework

Question

What is the best way to limit the items per page in Django REST Framework? I set PAGINATE_BY = 20 and PAGINATE_BY_PARAM. Without parameter you get 20 items but it is also possible to get 4000 items over the paginate param. This requests are very heavy and not very useful but perfect for script kiddies.

Jarus

Answer 1

If you want to set a hard maximum limit look at overriding the get_paginate_by method on the generic views.

Answer 2

You need to set PAGINATE_BY as doc states:

PAGINATE_BY: The default page size to use for pagination. If set to None, pagination is disabled by default

PAGINATE_BY_PARAM is for users to override the default size. So if you are afraid of its misuse just don't enable it.

PAGINATE_BY_PARAM: The name of a query parameter, which can be used by the client to override the default page size to use for pagination. If set to None, clients may not override the default page size.