# Client\_max\_body\_size

**URL:** <https://www.ruby-forum.com/t/client-max-body-size/227678>\
**Category:** NGINX\
**Created:** [March 24, 2013, 12:53pm UTC](https://www.ruby-forum.com/t/client-max-body-size/227678 "2013-03-24T12:53:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hagai\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/a9a28c/32.png) [@Hagai\_A](https://www.ruby-forum.com/u/Hagai_A)\
**Post date:** [March 24, 2013, 12:53pm UTC](https://www.ruby-forum.com/t/client-max-body-size/227678/1 "2013-03-24T12:53:49Z")

</div>

Hi

Is there any way to deny all requests with body?  
I know I can set set client\_max\_body\_size to 1 (byte)  
But… in that case Nginx reads all body request before finalizing the  
request.

In case of requests with body as part of attack I would like to close  
the  
connection  
immediately without wasting any processing on that request.

_I thought changing the code (ngx\_http\_core\_module.c:996) from:_

if (r-\>headers\_in.content\_length\_n != -1  
&& !r-\>discard\_body  
&& clcf-\>client\_max\_body\_size  
&& clcf-\>client\_max\_body\_size \< r-\>headers\_in.content\_length\_n)  
{  
ngx\_log\_error(NGX\_LOG\_ERR, r-\>connection-\>log, 0,  
“client intended to send too large body: %O  
bytes”,  
r-\>headers\_in.content\_length\_n);

```
    (void) ngx_http_discard_request_body(r);
    ngx_http_finalize_request(r, NGX_HTTP_REQUEST_ENTITY_TOO_LARGE);
    return NGX_OK;
}

```

_To:_

if (r-\>headers\_in.content\_length\_n != -1  
&& !r-\>discard\_body  
&& clcf-\>client\_max\_body\_size  
&& clcf-\>client\_max\_body\_size \< r-\>headers\_in.content\_length\_n)  
{  
ngx\_log\_error(NGX\_LOG\_ERR, r-\>connection-\>log, 0,  
“client intended to send too large body: %O  
bytes”,  
r-\>headers\_in.content\_length\_n);

```
   * ngx_close_connection(r->connection);*

    return NGX_OK;
}

```

Is that cover all or more changes are needed?  
Thanks  
Hagai

---

<div class="post-metadata">

**Author:** ![Hagai\_A](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/h/a9a28c/32.png) [@Hagai\_A](https://www.ruby-forum.com/u/Hagai_A)\
**Post date:** [March 27, 2013, 2:33pm UTC](https://www.ruby-forum.com/t/client-max-body-size/227678/2 "2013-03-27T14:33:25Z")

</div>

Hi  
I am trying to resend (with small modification…) my request for help  
Many Thanks  
Hagai

* * *

Hi

Is there any way to deny all requests with body?  
I know I can set set client\_max\_body\_size to 1 (byte)  
But… in that case Nginx reads all body request before finalizing the  
request.

In case of requests with body as part of attack I would like to close  
the  
connection  
immediately without wasting any processing on that request.

_I thought changing the code (ngx\_http\_core\_module.c:996) from:_

if (r-\>headers\_in.content\_length\_n != -1  
&& !r-\>discard\_body  
&& clcf-\>client\_max\_body\_size  
&& clcf-\>client\_max\_body\_size \< r-\>headers\_in.content\_length\_n)  
{  
ngx\_log\_error(NGX\_LOG\_ERR, r-\>connection-\>log, 0,  
“client intended to send too large body: %O  
bytes”,  
r-\>headers\_in.content\_length\_n);

```
    (void) ngx_http_discard_request_body(r);
    ngx_http_finalize_request(r, NGX_HTTP_REQUEST_ENTITY_TOO_LARGE);
    return NGX_OK;
}

```

_To:_

if (r-\>headers\_in.content\_length\_n != -1  
&& !r-\>discard\_body  
&& clcf-\>client\_max\_body\_size  
&& clcf-\>client\_max\_body\_size \< r-\>headers\_in.content\_length\_n)  
{  
ngx\_log\_error(NGX\_LOG\_ERR, r-\>connection-\>log, 0,  
“client intended to send too large body: %O  
bytes”,  
r-\>headers\_in.content\_length\_n);

```
   * ngx_connection_t* connection = r->connection;
    ngx_http_finalize_request(r, NGX_DONE);
    ngx_close_connection(connection);*

    return NGX_OK;
}

```

Is that cover all or more changes are needed?  
Thanks  
Hagai

–

_Hagai A._  
Qwilt | Work: +972-72-2221644| Mobile: +972-54-4895656 |  
removed\_email\_address@domain.invalid[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)