i was wondering if there is any securitiy risk involved with raising the client_max_body_size in nginx from 1MB to 20GB?
client_max_body_size to 20 GB is, obviously, not reasonable and I wonder why you would allow (users?, yourself?) to upload such very huge files.
client_max_body_size governs the corresponding HTTP Header parameter. As a security good practice, we must always limit the header and message body to a minimal reasonable length. Why ? 20 GB is so huge that you put your server in the same scenario as by 2013 when Django allowed users to use a very long password forcing Django (rather the server where it is hosted) to perform very expensive hash calculations leading, as you may guess, to a denial-of-service attack against the whole Django's authentication framework.
This is said, there are other things you need to think about if you increase too much the size of
client_max_body_size. For instance, how will you set
keepalive_timeout parameter ? How could you calculate it based on the fact that
client_max_body_size is set to 20 GB ? May be 20 seconds ? 20 minutes ? Two hours ? Same question concerns
client_body_timeout that set, respectiely, set the maximum amount of time Nginx will wait around on the client to specify a request header or ask for an object to be served.