# Why is client\_max\_body\_size default set to 1m? **URL:** \ **Category:** NGINX\ **Created:** [October 12, 2010, 6:23pm UTC](https://www.ruby-forum.com/t/why-is-client-max-body-size-default-set-to-1m/196394 "2010-10-12T18:23:41Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![jlangevin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/8e8cbc/32.png) [@jlangevin](https://www.ruby-forum.com/u/jlangevin)\ **Post date:** [October 12, 2010, 6:23pm UTC](https://www.ruby-forum.com/t/why-is-client-max-body-size-default-set-to-1m/196394/1 "2010-10-12T18:23:41Z")
After migrating one of our servers to Nginx from Apache, I decided to test file uploads (as I’ve implemented the Accelerated Upload Support feature in PHP-FPM/nginx). I found that [client\_max\_body\_size](http://wiki.nginx.org/NginxHttpCoreModule#client_max_body_size) is an additional directive that affects POST/upload file sizes. So this means that in addition to the 2 directives in PHP that must be configured for upload file size, I must also now configure Nginx as well? I can understand this directive existing, but why default it to 1mb? Found this issue due to this thread and my own failed upload attempts: > Posted at Nginx Forum: > **[Why is client\_max\_body\_size default set to 1m?](https://forum.nginx.org/read.php?2,139769,139769#msg-139769)** > > After migrating one of our servers to Nginx from Apache, I decided to test file uploads (as I've implemented the Accelerated Upload Support feature in PHP-FPM/nginx). I found that... ---
**Author:** ![jlangevin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/8e8cbc/32.png) [@jlangevin](https://www.ruby-forum.com/u/jlangevin)\ **Post date:** [October 12, 2010, 6:52pm UTC](https://www.ruby-forum.com/t/why-is-client-max-body-size-default-set-to-1m/196394/2 "2010-10-12T18:52:33Z")
Hello! On Tue, Oct 12, 2010 at 12:22:12PM -0400, jlangevin wrote: > I can understand this directive existing, but why default it to 1mb? > It is believed to be reasonably high for non-upload use cases, and > reasonably low to prevent DoS by uploading large files (with > default 1 worker processes and 512 worker connections it’s possible to > consume up to 512M in client\_body\_temp directory). For upload use cases one is probably going to tune it for his own limits anyway - taking into account available disk space and so on. Maxim D. ---
**Author:** ![jlangevin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/8e8cbc/32.png) [@jlangevin](https://www.ruby-forum.com/u/jlangevin)\ **Post date:** [October 12, 2010, 7:07pm UTC](https://www.ruby-forum.com/t/why-is-client-max-body-size-default-set-to-1m/196394/3 "2010-10-12T19:07:40Z")
In that case, if you had a server that you wanted to allow up to 32mb uploads managed via PHP scripts, how would you do so in a secure fashion (considering DOS)? Would you do a check for a certain request type (such as POST) as well as the requested URL? Or would it not be worthwhile to be that exact? Posted at Nginx Forum: > **[Re: Why is client\_max\_body\_size default set to 1m?](https://forum.nginx.org/read.php?2,139769,139782#msg-139782)** > > After migrating one of our servers to Nginx from Apache, I decided to test file uploads (as I've implemented the Accelerated Upload Support feature in PHP-FPM/nginx). I found that... ---
**Author:** ![jlangevin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/8e8cbc/32.png) [@jlangevin](https://www.ruby-forum.com/u/jlangevin)\ **Post date:** [October 12, 2010, 7:43pm UTC](https://www.ruby-forum.com/t/why-is-client-max-body-size-default-set-to-1m/196394/4 "2010-10-12T19:43:59Z")
Hello! On Tue, Oct 12, 2010 at 01:05:45PM -0400, jlangevin wrote: > In that case, if you had a server that you wanted to allow up to 32mb > uploads managed via PHP scripts, how would you do so in a secure fashion > (considering DOS)? Ideally, worker\_processes \* worker\_connections \* client\_max\_body\_size should be less than free space normally available for client\_body\_temp\_path. Though for large number of worker\_connections it’s a bit hard maintain this invariant, e.g. 64k connections with 32m limit will require 2T of disk space. So it’s probably good idea to apply other limits as well, e.g. limit\_conn. > Would you do a check for a certain request type (such as POST) as well > as the requested URL? > Or would it not be worthwhile to be that exact? Configuring client\_max\_body\_size only for particular locations may be beneficial, especially when combined with limit\_conn for requests in this location. Maxim D. ---
**Author:** ![jlangevin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/8e8cbc/32.png) [@jlangevin](https://www.ruby-forum.com/u/jlangevin)\ **Post date:** [October 12, 2010, 8:25pm UTC](https://www.ruby-forum.com/t/why-is-client-max-body-size-default-set-to-1m/196394/5 "2010-10-12T20:25:26Z")
Thanks Maxim, that’s very helpful! 🙂 Posted at Nginx Forum: > **[Re: Why is client\_max\_body\_size default set to 1m?](https://forum.nginx.org/read.php?2,139769,139808#msg-139808)** > > After migrating one of our servers to Nginx from Apache, I decided to test file uploads (as I've implemented the Accelerated Upload Support feature in PHP-FPM/nginx). I found that...