DefaultBodyLimit closing socket

[robko23]

• I have looked for existing issues (including closed) about this

Bug Report

Version

├── axum v0.6.2
│ ├── axum-core v0.3.1
│ ├── axum-macros v0.3.1 (proc-macro)

Platform

Linux home-workstation 6.0.12-300.fc37.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Dec 8 16:58:47 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Description

When I have the default server without any further modifications

axum::Server::bind(&addr)
    .serve(app.into_make_service())
    .with_graceful_shutdown(Self::shutdown_signal())
    .await.unwrap();

And send more than 2MB request body, it just closes the socket without any response and nothing in the log. I would expect either http response 413 Payload Too Large or warning in the log, or both.

Is this a bug or is it intended behaivor? I was debugging this way longer than I'd expected to.

Thanks

[davidpdrsn]

The default limit does nothing unless the body is consumed by an extractor. It also does use “payload too large” as the status.

So there is likely something else wrong. What does your app look like?

[robko23]

My app looks like this:

        let app = Router::new()
            .route("/json/:webhook_id", post(Self::webhook))
            .with_state(Arc::clone(&self.config));

        let addr = SocketAddr::from((self.config.server.bind_address, self.config.server.bind_port));
        info!("Listening on address: {}", addr);

        axum::Server::bind(&addr)
            .serve(app.into_make_service())
            .with_graceful_shutdown(Self::shutdown_signal())
            .await.unwrap();

And Self::webhook

    async fn webhook(
        Path(webhook_id): Path<String>,
        State(config): State<Arc<MainConfig>>,
        Json(payload): Json<serde_json::Value>,
    ) -> impl IntoResponse {
        info!("Processing request: {}", &settings.id);
...

When I tried to send dummy request (with body around 10MB) from python

import base64

import requests

image = open("2mb-image.jpg", 'rb')
data = base64.b64encode(image.read()).decode('ascii')

response = requests.post(url="http://localhost:3000/json/test", json={
    'image1': data,
    'image2': data,
    'image3': data,
    'image4': data,
    'image5': data
})
data = response.json()

print(data)

I got error

Traceback (most recent call last):
  File "/usr/lib/python3.11/site-packages/requests/models.py", line 971, in json
    return complexjson.loads(self.text, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/user/test.py", line 15, in <module>
    data = response.json()
           ^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/requests/models.py", line 975, in json
    raise RequestsJSONDecodeError(e.msg, e.doc, e.pos)
requests.exceptions.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

When we tried to call it from dotnet, it returned

System.IO.IOException: Unable to write data to the transport connection: Broken pipe.

And that's it. No error in logs, no 413.
And after little bit of digging I found out about the 2MB limit and added

            .layer(DefaultBodyLimit::disable())

to my app and everything just magically worked.

[davidpdrsn]

I'm tempted to say that is python's fault and not axum.

It works for me with:

use axum::{routing::post, Json, Router};
use std::net::SocketAddr;

#[tokio::main]
async fn main() {
    let app = Router::new().route("/", post(handler));

    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
    axum::Server::bind(&addr)
        .serve(app.into_make_service())
        .await
        .unwrap();
}

async fn handler(Json(value): Json<serde_json::Value>) {
    dbg!(value);
}

and

❯ curl -i localhost:3000/ -H "Content-Type: application/json" -d "@large.json"
HTTP/1.1 100 Continue

HTTP/1.1 413 Payload Too Large
content-type: text/plain; charset=utf-8
content-length: 56
date: Wed, 18 Jan 2023 12:48:53 GMT

Failed to buffer the request body: length limit exceeded

The default limits is a security feature. Without a default limit anyone can trivially DDos your app by sending an infinite payload. That is documented here https://docs.rs/axum/latest/axum/extract/index.html#request-body-limits

[robko23]

Hmm... I tried printing status code of the response in python and it is indeed 413. The python code was just a test and the dotnet app is the main caller, so it has to be something wrong with it's HTTP client. I would expect it to write something like "413 payload too large" and not "Broken pipe". Weird.

Anyway, sorry for the confusion and thanks for your time for helping me to resolve this.