How to use MaxRequestBodySize in ASP.NET Core on IIS with maxAllowedContentLength?

user_2978652 0
Viewed 8718

I have an ASP.NET Core web API running on IIS. In an operation, I set IHttpMaxRequestBodySizeFeature.MaxRequestBodySize to 262144000. I have used the IIS Configuration Editor to

  • modify ApplicationHost.config for my site by setting system.webServer/security/requestFiltering/requestLimits/maxAllowedContentLength to 4294967295 enter image description here
  • modify ApplicationHost.config for my site by setting system.webServer/serverRuntime/maxRequestEntityAllowed to 4294967295 enter image description here
  • modify Root Web.config for my site by setting system.web/httpRuntime/maxRequestLength to 2147483647 enter image description here

Those are the values I also see when I choose Web.config in the IIS Configuration Editor.

The site is behind another IIS site acting as a reverse proxy. I have made the same changes there.

I am able to upload files larger than the default ~30MB limit, but I consistently get the following warning whenever I set IHttpMaxRequestBodySizeFeature.MaxRequestBodySize to a large value:

Increasing the MaxRequestBodySize conflicts with the max value for IIS limit maxAllowedContentLength. HTTP requests that have a content-length greater than maxAllowedContentLength will still be rejected by IIS. You can disable the limit by either removing or setting the maxAllowedContentLength value to a higher limit.

I have even looked at the ASP.NET source code to verify that the warning only prints if you're trying to set the limit higher than the IIS settings ([1], [2]).

What am I doing wrong?

If it's relevant, I am publishing to IIS using Azure Pipelines. My repo does not contain a web.config, but for good measure I tried with the following web.config without luck:

<configuration>
  <system.web>
    <httpRuntime maxRequestLength="2147483647" />
  </system.web>
  <system.webServer>
    <security>
      <requestFiltering>
        <requestLimits maxAllowedContentLength="4294967295" />
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>
asp.net-core iis
2 Answers

Turns out there are several bugs in ASP.NET Core when setting the limits to values above Int32.MaxValue. Furthermore, the limit must be set in two places. See this issue and linked issues. In summary:

  • Set the web.config value system.webServer.security.requestFiltering.maxAllowedContentLength to Int32.MaxValue
  • In the app startup, set IISServerOptions.MaxRequestBodySize to Int32.MaxValue

That removes the warning (and of course limits requests to ~2GB).

user_29786520

Try to set the below code in Startup.cs file:

services.Configure<FormOptions>(opt =>
{
    opt.MultipartBodyLengthLimit = YOUR_MAX_TOTAL_UPLOAD_SIZE;
});

You could configure/modify maxAllowedContentLength property in your local web.config and deploy your app with web.config to your Azure Website.

<configuration>
  <location path="." inheritInChildApplications="false">
   <system.webServer>
     <handlers>
       <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModule" resourceType="Unspecified" />
     </handlers>
     <aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout">
       <environmentVariables />
     </aspNetCore>
   </system.webServer>
 </location>
 <system.webServer>
   <security>
      <requestFiltering>
        <requestLimits maxAllowedContentLength="YOUR_BYTES" />
       </requestFiltering>
    </security>
  </system.webServer>
</configuration>
user_111473460
Related