Skip to content

Document IISServerOptions.MaxRequestBodySize and IHttpMaxRequestBodySizeFeature in file upload guide - #37600

Merged
tdykstra merged 11 commits into
dotnet:mainfrom
SkyDevLab:docs/36039-upload-request-limits
Sep 15, 2026
Merged

tdykstra merged 11 commits into
dotnet:mainfrom
SkyDevLab:docs/36039-upload-request-limits

Conversation

@SkyDevLab

@SkyDevLab SkyDevLab commented Sep 5, 2026 •

Copy link
Copy Markdown
Contributor

… uploads (#36039)

Fixes #36039

Description

The file upload documentation (aspnetcore/mvc/models/file-uploads.md) previously explained Kestrel request size limits and IIS maxAllowedContentLength in web.config, but was missing guidance on IISServerOptions.MaxRequestBodySize for IIS in-process hosting as well as per-request dynamic body size configuration via IHttpMaxRequestBodySizeFeature.

This PR improves the "Server and app configuration" section by:

  • Detailing IISServerOptions.MaxRequestBodySize alongside maxAllowedContentLength and explaining how both limits interact when hosted in-process on IIS.
  • Documenting IHttpMaxRequestBodySizeFeature with a C# example for per-request request body size limits (including setting the limit to null and checking IsReadOnly).
  • Adding a summary table contrasting the scope, configuration, default value, and key notes for all request body size limit mechanisms (maxAllowedContentLength, IISServerOptions.MaxRequestBodySize, KestrelServerOptions.Limits.MaxRequestBodySize, RequestSizeLimitAttribute, and IHttpMaxRequestBodySizeFeature).

Changes

  • Expanded ### IIS in aspnetcore/mvc/models/file-uploads.md to document IISServerOptions.MaxRequestBodySize and explain dual IIS/ASP.NET Core limit enforcement.
  • Added ### Per-request request body size configuration in aspnetcore/mvc/models/file-uploads.md showing how to use IHttpMaxRequestBodySizeFeature.
  • Added ### Request body size limits summary in aspnetcore/mvc/models/file-uploads.md containing a comparison table for request size limit mechanisms.

Internal previews

File Preview link
aspnetcore/mvc/models/file-uploads.md Learn preview

Build report

@SkyDevLab

SkyDevLab commented Sep 5, 2026 via email

Copy link
Copy Markdown
Contributor Author

@SkyDevLab

SkyDevLab commented Sep 5, 2026 via email

Copy link
Copy Markdown
Contributor Author

@SkyDevLab

SkyDevLab commented Sep 6, 2026 via email

Copy link
Copy Markdown
Contributor Author

@SkyDevLab
SkyDevLab force-pushed the docs/36039-upload-request-limits branch from 0e52a59 to 6416599 Compare September 6, 2026 12:44
@wadepickett

Copy link
Copy Markdown
Contributor

@tdykstra to note review request.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Resolve the compatibility, namespace, IIS-limit wording, feature-state, and metadata issues before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates the ASP.NET Core file upload guide with IIS and per-request request body size limit guidance.

Changes:

  • Documents IISServerOptions.MaxRequestBodySize and IIS limit interactions.
  • Adds IHttpMaxRequestBodySizeFeature usage guidance.
  • Adds a request body size limits comparison table.
File summaries
File Summary
aspnetcore/mvc/models/file-uploads.md Adds IIS, per-request, and request-size-limit documentation.
Review details

Suppressed comments (5)

aspnetcore/mvc/models/file-uploads.md:786

  • The surrounding content is also visible for ASP.NET Core 5, but app.MapPost on a WebApplication is a .NET 6+ minimal-API pattern. This example won't compile for the 5.0 audience; use the middleware/Startup form for 5.0 or restrict the example to >= aspnetcore-6.0.
app.MapPost("/upload", async (HttpContext context) =>

aspnetcore/mvc/models/file-uploads.md:788

  • The code sample uses IHttpMaxRequestBodySizeFeature without importing Microsoft.AspNetCore.Http.Features. That namespace isn't part of the standard ASP.NET Core implicit usings, so copying this Program.cs example produces an unresolved-type compile error unless the reader adds an import.
    var maxRequestBodySizeFeature = context.Features.Get<IHttpMaxRequestBodySizeFeature>();

aspnetcore/mvc/models/file-uploads.md:779

  • The parenthetical is misleading about what the attribute can replace: RequestSizeLimitAttribute can override the ASP.NET Core limit for a specific action, but it cannot replace or bypass IIS's maxAllowedContentLength. The IIS filtering limit must still be raised for a larger upload, so make that requirement explicit.
> When hosted in-process on IIS, both limits apply. If `maxAllowedContentLength` is smaller than `IISServerOptions.MaxRequestBodySize`, IIS rejects requests exceeding `maxAllowedContentLength` before ASP.NET Core processes them. To support larger uploads on IIS, increase both `maxAllowedContentLength` in `web.config` and `IISServerOptions.MaxRequestBodySize` (or apply <xref:Microsoft.AspNetCore.Mvc.RequestSizeLimitAttribute>).

aspnetcore/mvc/models/file-uploads.md:811

  • The summary is in the same >= aspnetcore-5.0 block, but this configuration spelling again assumes the .NET 6 minimal-hosting builder API. For ASP.NET Core 5.0, the table should direct readers to services.Configure<IISServerOptions> in Startup.ConfigureServices, or this row needs a version-specific moniker.
| `IISServerOptions.MaxRequestBodySize` | ASP.NET Core IIS server | `builder.Services.Configure<IISServerOptions>` | 30,000,000 bytes (~28.6 MB) | Enforced by ASP.NET Core IIS in-process server handler. |

aspnetcore/mvc/models/file-uploads.md:801

  • IsReadOnly can also become true when the connection has been upgraded; it doesn't necessarily mean that the request body has already been read. Describe it as indicating that the feature is no longer writable (and include the upgrade case) so this guidance matches the API contract.
* The limit must be configured **before** the app begins reading the request body. If `IsReadOnly` is `true`, the request body has already been read and attempting to set `MaxRequestBodySize` throws an <xref:System.InvalidOperationException>.
  • Files reviewed: 1/1 changed files
  • Comments generated: 2
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread aspnetcore/mvc/models/file-uploads.md
Comment thread aspnetcore/mvc/models/file-uploads.md
tdykstra and others added 2 commits September 15, 2026 13:55
Updated the location for customizing the request body size limit in ASP.NET Core documentation.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Update the date for file uploads documentation.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Compatibility and documentation issues remain unresolved.

Review details

Suppressed comments (6)

Previously missed (2) — in code that hasn't changed since the last review.

aspnetcore/mvc/models/file-uploads.md:797

  • The article's outer :::moniker starts at >= aspnetcore-5.0, but this sample uses app.MapPost, a .NET 6 minimal-API endpoint that isn't available in the ASP.NET Core 5.0 view. Either gate this example at >= aspnetcore-6.0 and add a 5.0 alternative, or use the middleware form so the sample works for the enclosing moniker.
    aspnetcore/mvc/models/file-uploads.md:779
  • The parenthetical makes RequestSizeLimitAttribute sound like an alternative to increasing both IIS limits, but the attribute only overrides the ASP.NET Core limit; IIS still rejects requests above maxAllowedContentLength before the action runs, as the later guidance correctly states. Clarify that the IIS limit must be increased and the attribute can replace only the global IISServerOptions setting for a specific action or page.

aspnetcore/mvc/models/file-uploads.md:802

  • The parenthetical is incomplete: HTTP.sys also exposes this feature over HttpSysOptions.MaxRequestBodySize, so the current wording incorrectly limits the feature to Kestrel and IIS. Refer to the active ASP.NET Core server limit instead; the IIS maxAllowedContentLength caveat can remain specific to IIS.
* Changing `IHttpMaxRequestBodySizeFeature.MaxRequestBodySize` or applying <xref:Microsoft.AspNetCore.Mvc.RequestSizeLimitAttribute> only overrides ASP.NET Core server limits (Kestrel or `IISServerOptions`). It does **not** bypass the IIS module-level `maxAllowedContentLength` limit configured in `web.config`.

aspnetcore/mvc/models/file-uploads.md:812

  • These rows are rendered inside the article's >= aspnetcore-5.0 block, but builder.Services and builder.WebHost refer to the .NET 6 minimal-hosting builder and aren't valid configuration expressions for the ASP.NET Core 5.0 view. Also, KestrelServerOptions.Limits.MaxRequestBodySize isn't the owning API; use KestrelServerLimits.MaxRequestBodySize. Use the Startup/webBuilder forms here, or gate this table at >= aspnetcore-6.0.
| `IISServerOptions.MaxRequestBodySize` | ASP.NET Core IIS server | `builder.Services.Configure<IISServerOptions>` | 30,000,000 bytes (~28.6 MB) | Enforced by ASP.NET Core IIS in-process server handler. |
| `KestrelServerOptions.Limits.MaxRequestBodySize` | ASP.NET Core Kestrel server | `builder.WebHost.ConfigureKestrel` | 30,000,000 bytes (~28.6 MB) | Enforced by Kestrel server. |

aspnetcore/mvc/models/file-uploads.md:7

  • This updated Markdown file is missing the required ai-usage: ai-assisted metadata. Add it immediately below title so the front matter records the AI assistance used for this change.
ms.date: 09/15/2026

aspnetcore/mvc/models/file-uploads.md:769

  • Link this newly documented API with an xref instead of leaving it as plain code. The older moniker block in this same article already uses <xref:Microsoft.AspNetCore.Builder.IISServerOptions.MaxRequestBodySize%2A?displayProperty=nameWithType> for the same property.
* **ASP.NET Core IIS server options (`IISServerOptions.MaxRequestBodySize`)**: ASP.NET Core also enforces a default request body size limit of 30,000,000 bytes (~28.6 MB) when hosted in-process. Customize this limit in `Startup.ConfigureServices`:
  • Files reviewed: 1/1 changed files
  • Comments generated: 0 new
  • Review effort level: Lite

Comment thread aspnetcore/mvc/models/file-uploads.md Outdated
Updated moniker boundry to >= 6.0 from 5.0
Comment thread aspnetcore/mvc/models/file-uploads.md Outdated
Co-authored-by: Wade Pickett <wpickett@microsoft.com>
Comment thread aspnetcore/mvc/models/file-uploads.md Outdated
Changing startup to program.cs to match monker versions.
Updated code snippet to use 'builder.Services' for configuring IISServerOptions in ASP.NET Core.

@wadepickett wadepickett left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved after fixing the stale moniker version and matching the startup pattern for 6.0.

Updated code block formatting for IISServerOptions.MaxRequestBodySize in file-uploads.md.
Clarified the rejection message for requests exceeding IIS limit.
Updated section title for clarity regarding request body size limits.

@wadepickett wadepickett left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@wadepickett

Copy link
Copy Markdown
Contributor

@SkyDevLab, thanks very much for your contribution!!

@tdykstra, re-review is needed. I fixed a problem with moniker version/example alignment.

@tdykstra
tdykstra merged commit f5b4f6f into dotnet:main Sep 15, 2026
5 checks passed
@tdykstra
tdykstra requested a lite review from Copilot September 16, 2026 02:25

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Several moderate documentation issues remain, including IIS limit guidance and incomplete code-example details.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (7)

Previously missed (3) — in code that hasn't changed since the last review.

aspnetcore/mvc/models/file-uploads.md:780

  • This alternative is misleading: RequestSizeLimitAttribute only overrides the ASP.NET Core server limit and cannot raise IIS's maxAllowedContentLength. As written, a reader can apply the attribute while leaving the IIS limit at 28.6 MB and still have larger uploads rejected with 404.13. State that maxAllowedContentLength must be increased, then either configure IISServerOptions globally or use the attribute per endpoint.
    aspnetcore/mvc/models/file-uploads.md:789
  • This code example uses IHttpMaxRequestBodySizeFeature without importing Microsoft.AspNetCore.Http.Features. That namespace is not included by the standard ASP.NET Core web implicit usings, so copying the snippet into Program.cs produces an unresolved type; add the using directive to the example.
    aspnetcore/mvc/models/file-uploads.md:770
  • Link the newly introduced API reference instead of leaving it as plain inline code. The same article already uses the API xref for this property in the legacy IIS section, and the xref makes the new option discoverable in the published docs.

aspnetcore/mvc/models/file-uploads.md:8

  • The metadata date is one day behind the current review date. Please use today's date for ms.date.
ms.date: 09/15/2026

aspnetcore/mvc/models/file-uploads.md:807

  • This table is presented as a summary of the request-body limits, but it omits FormOptions.MultipartBodyLengthLimit, which is documented just above as a separate 128 MB default that can reject multipart uploads independently of the server request-body limits. Add that mechanism to the table so readers troubleshooting upload-size failures don't miss the form parser limit.
The following table summarizes the request body size limit mechanisms in ASP.NET Core:

aspnetcore/mvc/models/file-uploads.md:801

  • null only removes the server's request-body limit. Multipart file binding still applies FormOptions.MultipartBodyLengthLimit (134,217,728 bytes by default, documented above), so the current "unlimited" wording can lead users to expect an unlimited file upload. Qualify this bullet and point to that separate limit.
* Setting `MaxRequestBodySize` to `null` disables the ASP.NET Core server-side limit for that request.

aspnetcore/mvc/models/file-uploads.md:813

  • KestrelServerOptions.Limits.MaxRequestBodySize is a configuration path, not the owning API type; the property is on KestrelServerLimits. Using the current dotted name as the mechanism makes the summary point readers to an API that doesn't exist in that form. Use the owning API name, as documented in aspnetcore/fundamentals/servers/kestrel/options.md:44-58.
| `KestrelServerOptions.Limits.MaxRequestBodySize` | ASP.NET Core Kestrel server | `builder.WebHost.ConfigureKestrel` | 30,000,000 bytes (~28.6 MB) | Enforced by Kestrel server. |
  • Files reviewed: 1/1 changed files
  • Comments generated: 1
  • Review effort level: Lite

:::moniker-end

:::moniker range=">= aspnetcore-3.0 < aspnetcore-5.0"
:::moniker range=">= aspnetcore-3.0 < aspnetcore-6.0"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

UUF: File Uploads: Missing IISServerOptions and IHttpMaxRequestBodySizeFeature

4 participants