ASP.net HTTP 404 - File not found instead of MaxRequestLength exception

Question

I have a file upload control on my webpage. The maximum request length is set to 8 MB (maxRequestLength = 8192). I also have server validation that throws an error if the file is more than 4MB. The reason that its 8MB in the config is the leverage that's given to the user and also so that the application can be tested.

If I upload a file that's 9MB, I get thrown an exception Maximum request length exceeded., which is fine and working as expected. But when I try to upload a file that's 1GB, it shows me a HTTP 404 - File not found. Can someone please explain why this is happening and how can I get it to throw me a maxRequestLength exception?

I'm using IIS6.

Answer 1

I experienced this condition today (HTTP 404 on large file upload with IIS 7) but I thought I had made all the correct configuration settings. I wanted to upload files up to 300MB so I made the following web.config settings in a sub-folder of the application:

<configuration>
    <system.web>
        <httpRuntime maxRequestLength="307200" />
    </system.web>
    <system.webServer>
        <security>
            <requestFiltering>
                <requestLimits maxAllowedContentLength="314572800" />
            </requestFiltering>
        </security>
    </system.webServer>
</configuration>

This configuration worked in test but when I copied the updated files including the web.config to the production server, I received the HTTP 404 error on uploading a 90MB file. Smaller files under the application-wide limit of 30MB were working fine, so I knew it was a request size problem of some sort.

I figured there was a chance IIS had cached some application settings and just hadn't updated them, so I recycled the Application Pool, after which everything worked as expected.

Answer 2

I feel none of the answers here explain why you get a 404, they just tell you the usual stuff of how to fix the problem.

The 404 is not due to misconfiguration, it is intentional and documented behaviour:

When request filtering blocks an HTTP request because an HTTP request exceeds the request limits, IIS 7 will return an HTTP 404 error to the client and log one of the following HTTP statuses with a unique substatus that identifies the reason that the request was denied:

HTTP Substatus    Description

404.13            Content Length Too Large
404.14            URL Too Long
404.15            Query String Too Long

These substatuses allow Web administrators to analyze their IIS logs and identify potential threats.

In addition, when an HTTP request exceeds the header limits that are defined in the in the <headerLimits> element, IIS 7 will return an HTTP 404 error to the client with the following substatus:

HTTP Substatus    Description

404.10            Request Header Too Long

Answer 3

This is a bit of an old thread, but I thought I should add my experiences with this.

I faced the same problem with large file uploads and the web api. A 404.13 is thrown before it gets to a controller at all, so I had to find out where to jump in and handle this case.

My solution was the following web.config entries:

I handle the 404.13 by redirecting it to a mvc controller (it could be a webforms page just the same), and regular 404 errors hit my 404 route. it's critical that the responseMode="redirect" for the 404.13

<httpErrors errorMode="Custom">
  <remove statusCode="404" subStatusCode="-1" />            
  <error statusCode="404" subStatusCode="13" path="/errors/filesize" responseMode="Redirect" />
  <error statusCode="404" path="/errors/notfound" responseMode="ExecuteURL" />      
</httpErrors>

Then, in my Errors controller, I have the following:

public ActionResult FileSize()
{
    Response.StatusCode = 500;
    Response.StatusDescription = "Maximum file size exceeded.";
    Response.End();
    return null;
}

Again, this could be a regular webforms page.

Answer 4

To my knowledge, there is no way to gracefully handle exceeding IIS's "maxRequestLength" setting. It can't even display a custom error page (since there is no corresponding HTTP code to respond to). The only way around this is to set maxRequestLength to some absurdly high number of kbytes, for example 51200 (50MB), and then check the ContentLength after the file has been uploaded (assuming the request didn't time out before 90 seconds). At that point, I can validate if the file <=5MB and display a friendly error.

You can also try this link.

You could also try something like this:

private void application_EndRequest(object sender, EventArgs e)
{
    HttpRequest request = HttpContext.Current.Request;
    HttpResponse response = HttpContext.Current.Response;

    if ((request.HttpMethod == "POST") &&
        (response.StatusCode == 404 && response.SubStatusCode == 13))
    {
        // Clear the response header but do not clear errors and transfer back to requesting page to handle error
        response.ClearHeaders();
        HttpContext.Current.Server.Transfer(request.AppRelativeCurrentExecutionFilePath);
    }
}

Answer 5

I have found that this problem can also be caused on IIS7 (and presumably IIS6) when the URLScan tool is installed and running on the site.

When uploading the file to a website i was receiving the message "File or directory not found. The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable."

If the problem is being caused by URLScan then if you try to upload the large file to the site whilst browsing the site on the hosting server itself, you will be served a full asp.net error message instead of a 404 that mentions URLScan. You can also check if URLScan is running on you site in IIS7 by viewing the ISAPI Filters for the website in IIS, URLScan will be listed if it is used.

This can be fixed by altering the ini file for URLScan is located at "%WINDIR%\System32\Inetsrv\URLscan" and changing the MaxAllowedContentLength. The MaxAllowedContentLength is in bytes.

This may require a IIS restart to take effect, though it did not when i tried it myself with IIS7.

http://www.iis.net/learn/extensions/working-with-urlscan/urlscan-overview

http://www.iis.net/learn/extensions/working-with-urlscan/common-urlscan-scenarios

Answer 6

You could configure the default error page in IIS itself.

Answer 7

The request limit is a setting is IIS. Open the Request Filtering section of your site in IIS and select Edit Request Settings. For me it was that simple.

A more detailed How To from Microsoft.

https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/requestfiltering/#how-to-edit-the-request-filtering-feature-settings-and-request-limits

Answer 8

I just met the same problem, i made the similar operation like pseudocoder's answer but have different( i think maybe is not the cache) :

1. edit your Web.config --> maxRequestLength

   <system.web>
   <httpRuntime maxRequestLength="1073741824" executionTimeout="3600" />
   </system.web>
   

2. edit this:

   <security>
         <requestFiltering>
           <requestLimits maxAllowedContentLength="1073741824" />
         </requestFiltering>
   </security>
   

just like this,and try it.

Answer 9

The problem with the 1GB uploads is more browser related. I have had heaps of trouble with it and tried a lot of solutions but really the question to ask here is what are the chances of this happening in the real world for your business needs and maybe it should be recorded as a known issue in the business rules or non functional requirements document.