Why is client_max_limit required to use limit?

[n-studio]

compose_page_url has the following code:
limit_key => (limit_token || limit if client_max_limit) }.each { |k, v| v ? h[k] = v : h.delete(k) }

So pagination will ignore the limit unless client_max_limit is set. Why?

[ddnexus]

no, that code ignores the limit in the url that is being composed

[n-studio]

I mean, the links generated in series_nav are ignoring the limit parameter given to pagy.

For example, if I write pagy(query, limit: params[:limit])

The links to the pages won't carry the limit in the url, unless I add the client_max_limit parameter.

This was not the behavior pre v43.

[ddnexus]

If your code sets a limit it is applied to the pagination, not to the url.

Indeed, unless you set a client max limit, the client is not allowed to change the limit, and that param must be ignored from the request, therefore there is no point in adding a limit params to the link urls.

This was not the behavior pre v43.

Versions prior to 43 use the limit_extra variable to allow the behavior. V43 does not use extras and the client_limit_param is used as a numeric value and as the implicit switch for the behavior.

[n-studio]

Oh, I understand now. It's a built-in protection to avoid a malicious user to query 1_000_000 records and crash the application. Clever. Thank you!