New default 30 MB (~28.6 MiB) max request body size limit

[halter73]

Starting in ASP.NET Core 2.0.0, both Kestrel and HttpSys will be enforcing a a 30MB (~28.6 MiB) max request body size limit.

If the request body size exceeds the configured max request body size limit, the call to Request.Body.ReadAsync will throw an IOException. If this exception is uncaught, Kestrel will respond with a 413 Payload Too Large response and HttpSys will respond with a generic 500 Internal Server Error response.

This limit can be changed either globally or on a per-request basis, and is disabled for Kestrel running behind IIS where the normal web.config limit still applies.

MVC Instructions

If you want to change the max request body size limit for a specific MVC action or controller, you can use the RequestSizeLimit attribute. The following would allow MyAction to accept request bodies up to 100,000,000 bytes.

    [HttpPost]
    [RequestSizeLimit(100_000_000)]
    public IActionResult MyAction([FromBody] MyViewModel data)
    {

[DisableRequestSizeLimit] can be used to make request size unlimited. This effectively restores pre-2.0.0 behavior for just the attributed action or controller.

Generic Middleware Instructions

If the request is not being handled by an MVC action, the limit can still be modified on a per request basis using the IHttpMaxRequestBodySizeFeature. For example:

app.Run(async context =>
{
    context.Features.Get<IHttpMaxRequestBodySizeFeature>().MaxRequestBodySize = 100_000_000;

MaxRequestBodySize is a nullable long. Setting it to null disables the limit like MVC's [DisableRequestSizeLimit].

You can only configure the limit on a request if the application hasn’t started reading yet; otherwise an exception is thrown. There’s an IsReadOnly property that tells you if the MaxRequestBodySize property is in read-only state, meaning it’s too late to configure the limit.

Global Config Instructions

If you want to modify the max request body size globally, this can be done by modifying a MaxRequestBodySize property in the callback of either UseKestrel or UseHttpSys. MaxRequestBodySize is a nullable long in both cases. Ex:

.UseKestrel(options =>
{
    options.Limits.MaxRequestBodySize = null;

.UseHttpSys(options =>
{
    options.MaxRequestBodySize = 100_000_000;

---

Please use aspnet/ServerTests#92 for further discussion.