Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New default 30 MB (~28.6 MiB) max request body size limit #267

halter73 opened this issue Aug 4, 2017 · 0 comments

New default 30 MB (~28.6 MiB) max request body size limit #267

halter73 opened this issue Aug 4, 2017 · 0 comments


Copy link

@halter73 halter73 commented Aug 4, 2017

Starting in ASP.NET Core 2.0.0, both Kestrel and HttpSys will be enforcing a a 30MB (~28.6 MiB) max request body size limit.

If the request body size exceeds the configured max request body size limit, the call to Request.Body.ReadAsync will throw an IOException. If this exception is uncaught, Kestrel will respond with a 413 Payload Too Large response and HttpSys will respond with a generic 500 Internal Server Error response.

This limit can be changed either globally or on a per-request basis, and is disabled for Kestrel running behind IIS where the normal web.config limit still applies.

MVC Instructions

If you want to change the max request body size limit for a specific MVC action or controller, you can use the RequestSizeLimit attribute. The following would allow MyAction to accept request bodies up to 100,000,000 bytes.

    public IActionResult MyAction([FromBody] MyViewModel data)

[DisableRequestSizeLimit] can be used to make request size unlimited. This effectively restores pre-2.0.0 behavior for just the attributed action or controller.

Generic Middleware Instructions

If the request is not being handled by an MVC action, the limit can still be modified on a per request basis using the IHttpMaxRequestBodySizeFeature. For example:

app.Run(async context =>
    context.Features.Get<IHttpMaxRequestBodySizeFeature>().MaxRequestBodySize = 100_000_000;

MaxRequestBodySize is a nullable long. Setting it to null disables the limit like MVC's [DisableRequestSizeLimit].

You can only configure the limit on a request if the application hasn’t started reading yet; otherwise an exception is thrown. There’s an IsReadOnly property that tells you if the MaxRequestBodySize property is in read-only state, meaning it’s too late to configure the limit.

Global Config Instructions

If you want to modify the max request body size globally, this can be done by modifying a MaxRequestBodySize property in the callback of either UseKestrel or UseHttpSys. MaxRequestBodySize is a nullable long in both cases. Ex:

.UseKestrel(options =>
    options.Limits.MaxRequestBodySize = null;
.UseHttpSys(options =>
    options.MaxRequestBodySize = 100_000_000;

Please use aspnet/ServerTests#92 for further discussion.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
1 participant
You can’t perform that action at this time.