Oathkeeper docs claim a max_request_body_size config on the remote authorizer that doesn't exist in the schema or source

[rsurendra21]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

The Oathkeeper documentation page for the authz pipeline
(https://www.ory.com/docs/oathkeeper/pipeline/authz) describes a
max_request_body_size setting on the remote authorizer that does
not exist in the config schema or the actual implementation.

The page states:

The maximum inbound request body size that Ory Oathkeeper buffers
so it can replay the body to the upstream service. The default is
"10MiB".

Ory Oathkeeper rejects requests that exceed the limit with HTTP 413
before calling the remote authorizer.

This appears to be incorrect / describes a feature that was never
implemented:

• spec/config.schema.json defines configAuthorizersRemote and
  configAuthorizersRemoteJSON with only remote, headers,
  forward_response_headers_to_upstream, retry (and payload for
  the JSON variant) — no max_request_body_size property on either.
• pipeline/authz/remote.go and pipeline/authz/utils.go
  (pipeRequestBody) pipe the request body via an unbounded
  io.TeeReader into a bytes.Buffer — no size check, no cap, no
  HTTP 413 anywhere in either file.
• A GitHub commit search for MaxRequestBodySize across the full
  repo history returns zero results — this identifier has never
  existed in the codebase.

Suggested fix: remove the claim from the docs page, or if this was a
planned-but-unshipped feature, mark it clearly as not yet available.

Reproducing the bug

Not applicable in the docker/curl sense — this is a documentation
inaccuracy, not a runtime bug. To verify:

1. Visit https://www.ory.com/docs/oathkeeper/pipeline/authz and read
   the remote authorizer section — note the max_request_body_size
   / 10MiB / HTTP 413 claim.
2. Check spec/config.schema.json on the master branch — search for
   max_request_body_size: no match under either the remote or
   remote_json authorizer definitions.
3. Check pipeline/authz/remote.go and pipeline/authz/utils.go on the
   master branch — no body size limit logic anywhere in either
   file; pipeRequestBody() buffers the body unbounded.
4. Search commit history for MaxRequestBodySize — zero results.

Relevant log output

N/A — this is a documentation inaccuracy, not a runtime error. No
logs to provide.

Relevant configuration

N/A — no runtime config triggers this. For reference, the actual
(correct) schema for the affected section, from
spec/config.schema.json on the master branch:

authorizers:
  remote:
    config:
      remote: <url>
      headers: {}
      forward_response_headers_to_upstream: []
      retry: {}

No max_request_body_size property exists here or under remote_json.

Version

master

On which operating system are you observing this issue?

None

In which environment are you deploying?

None

Additional Context

No response