3

Recently I'm working with the Azure Application Gateway and when I try to upload a file I got the response 413 Entity Too Large. I read about it and the limit for the file upload is 2GB but I'm very confused because I uploaded successfully a file of 3.2 GB. Are there any change in this limit?. It fails when I try to upload a file of 4.6 GB. I'm using Standard_v2 SKU size.

Daniel Mann
  • 57,011
  • 13
  • 100
  • 120
yosel vera
  • 106
  • 2
  • 9

2 Answers2

6

Other answer is misleading or poorly written. This answer should make it clearer as there are a few details

Considering you want to enable the maximum limits on the V2 SKU, it behaves like this:

  • No WAF enabled: 4GB (this is 2GB on V1 SKU) - the type of request does not matter, can be a non-upload request.
  • Any configuration with WAF enabled without 'Inspect request body': 4GB - the type of request does not matter, can be a non-upload request.
  • WAF enabled via 'Application Gateway WAF policy' resource (this is a separate resouce) and OWASP 3.2 policy with 'Inspect request body' checked and with value 4000 on 'Max file upload size (MB)': 4GB - but only when your request has the Content-Type set to multipart/form-data, this will recognize it as a file upload (I've tested a bunch of other header values, and so far that one is only recognized as a file upload). Any other content type will result in the evaluation of the maximum value set in the 'Max request body size (KB)' field, which can only handle 2000KB (2MB) as maximum value on OWASP 3.2 currently and just 128 KB for lower OWASP versions.

If you go over the limit, you get the following message with HTTP status code 403:

<html>

<head>
    <title>403 Forbidden</title>
</head>

<body>
    <center>
        <h1>403 Forbidden</h1>
    </center>
    <hr>
    <center>Microsoft-Azure-Application-Gateway/v2</center>
</body>

</html>
r3verse
  • 1,000
  • 8
  • 19
  • How to proccede when you want to chunk file upload for example for 8MB? – Augustas Dec 06 '22 at 14:11
  • @Augustas if you need 'Inspect request body' enabled you can still make exclusions for specific scenarios, see: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration?tabs=portal#identify-request-attributes-to-exclude – r3verse Dec 07 '22 at 15:15
3

If you have WAF enabled and if your content type is a form based like application/json or application/xml or multipart/form-data , then it is considered as non-file upload.

OWASP rule is blocking the file upload. Check here for the rule definition.

Work with your application team to change the content type or disable the rule in your WAF is you feel it is not an attach to your application.

msrini-MSIT
  • 1,444
  • 1
  • 7
  • 11