i was wondering if there is any securitiy risk involved with raising the client_max_body_size in nginx from 1MB to 20GB?

1 Answer 1


Setting client_max_body_size to 20 GB is, obviously, not reasonable and I wonder why you would allow (users?, yourself?) to upload such very huge files.

client_max_body_size governs the corresponding HTTP Header parameter. As a security good practice, we must always limit the header and message body to a minimal reasonable length. Why ? 20 GB is so huge that you put your server in the same scenario as by 2013 when Django allowed users to use a very long password forcing Django (rather the server where it is hosted) to perform very expensive hash calculations leading, as you may guess, to a denial-of-service attack against the whole Django's authentication framework.

This is said, there are other things you need to think about if you increase too much the size of client_max_body_size. For instance, how will you set keepalive_timeout parameter ? How could you calculate it based on the fact that client_max_body_size is set to 20 GB ? May be 20 seconds ? 20 minutes ? Two hours ? Same question concerns client_header_timeout and client_body_timeout that set, respectiely, set the maximum amount of time Nginx will wait around on the client to specify a request header or ask for an object to be served.

  • I have a Reverse proxy and behind that there is a server with owncloud on, the reverse proxy was putting a limit where i could only upload 1 mb. to my Owncloud server, and that was the only solution i could come up with. Jul 21, 2015 at 7:08
  • @DanielGuldbergAaes That is good. And remember to think about security in terms of layered defense
    – user45139
    Jul 21, 2015 at 7:18
  • so it wont be a problem ? is that what you mean? Jul 21, 2015 at 7:40
  • @DanielGuldbergAaes By good I mean it is better you expose your proxy rather than your main servers. That is all. But I said you have to think in terms of layered security, I mean what I outlined through my answer concerning your main server is applicable to your proxy server too because this late one is not DDoS safe by default.
    – user45139
    Jul 21, 2015 at 7:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .