Any security risk with raising client_max_body_size nginx?

Question

i was wondering if there is any securitiy risk involved with raising the client_max_body_size in nginx from 1MB to 20GB?

Answer 1

Setting client_max_body_size to 20 GB is, obviously, not reasonable and I wonder why you would allow (users?, yourself?) to upload such very huge files.

client_max_body_size governs the corresponding HTTP Header parameter. As a security good practice, we must always limit the header and message body to a minimal reasonable length. Why ? 20 GB is so huge that you put your server in the same scenario as by 2013 when Django allowed users to use a very long password forcing Django (rather the server where it is hosted) to perform very expensive hash calculations leading, as you may guess, to a denial-of-service attack against the whole Django's authentication framework.

This is said, there are other things you need to think about if you increase too much the size of client_max_body_size. For instance, how will you set keepalive_timeout parameter ? How could you calculate it based on the fact that client_max_body_size is set to 20 GB ? May be 20 seconds ? 20 minutes ? Two hours ? Same question concerns client_header_timeout and client_body_timeout that set, respectiely, set the maximum amount of time Nginx will wait around on the client to specify a request header or ask for an object to be served.