CODEWITHSUNDEEP
azureazure-application-gateway
yosel vera
yosel vera

Reputation: 116

Azure Application Gateway file upload limits

Recently I'm working with the Azure Application Gateway and when I try to upload a file I got the response 413 Entity Too Large. I read about it and the limit for the file upload is 2GB but I'm very confused because I uploaded successfully a file of 3.2 GB. Are there any change in this limit?. It fails when I try to upload a file of 4.6 GB. I'm using Standard_v2 SKU size.

Upvotes: 4

Views: 11787

Answers (2)

r3verse
r3verse

Reputation: 1080

Other answer is misleading or poorly written. This answer should make it clearer as there are a few details

Considering you want to enable the maximum limits on the V2 SKU, it behaves like this:

  • No WAF enabled: 4GB (this is 2GB on V1 SKU) - the type of request does not matter, can be a non-upload request.
  • Any configuration with WAF enabled without 'Inspect request body': 4GB - the type of request does not matter, can be a non-upload request.
  • WAF enabled via 'Application Gateway WAF policy' resource (this is a separate resouce) and OWASP 3.2 policy with 'Inspect request body' checked and with value 4000 on 'Max file upload size (MB)': 4GB - but only when your request has the Content-Type set to multipart/form-data, this will recognize it as a file upload (I've tested a bunch of other header values, and so far that one is only recognized as a file upload). Any other content type will result in the evaluation of the maximum value set in the 'Max request body size (KB)' field, which can only handle 2000KB (2MB) as maximum value on OWASP 3.2 currently and just 128 KB for lower OWASP versions.

If you go over the limit, you get the following message with HTTP status code 403:

<html>

<head>
    <title>403 Forbidden</title>
</head>

<body>
    <center>
        <h1>403 Forbidden</h1>
    </center>
    <hr>
    <center>Microsoft-Azure-Application-Gateway/v2</center>
</body>

</html>

Read

Upvotes: 7

msrini-MSIT
msrini-MSIT

Reputation: 1502

If you have WAF enabled and if your content type is a form based like application/json or application/xml or multipart/form-data , then it is considered as non-file upload.

OWASP rule is blocking the file upload. Check here for the rule definition.

Work with your application team to change the content type or disable the rule in your WAF is you feel it is not an attach to your application.

Upvotes: 4

Related Questions