Skip to content

fix: return 413 when the request body exceeds the configured limit - #2785

Open
dunglas wants to merge 2 commits into
mainfrom
fix/request-body-too-large
Open

dunglas wants to merge 2 commits into
mainfrom
fix/request-body-too-large

Conversation

@dunglas

@dunglas dunglas commented Oct 27, 2026

Copy link
Copy Markdown
Member

go_read_post discarded read errors, so PHP saw a truncated php://input when Caddy's request_body max_size (or any http.MaxBytesReader) was exceeded. The request is now rejected with 413 if the error is a *http.MaxBytesError and response headers have not been sent yet. This works in classic and worker mode.

Fixes #2781

go_read_post dropped read errors, so PHP saw a truncated php://input
when Caddy's request_body max_size was exceeded.
Comment thread frankenphp.go Outdated
@AlliBalliBaba

Copy link
Copy Markdown
Contributor

I kind of dislike the silent exit TBH. I could imagine it leading to issues that are hard to debug.

Throwing an error instead feels a bit better, but it would force every application to handle that error.

What I'd actually prefer instead is maybe just buffering all chunked body requests per default so they never reach PHP before fully buffered. Makes it more consistent with what the CGI protocol expects. Similar idea to #2541.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Request bodies exceeding request_body max_size are silently truncated instead of returning 413 (classic and worker)

3 participants