client_max_body_size and chunked encoding

[Sergey Kandaurov]

> On 17 Feb 2021, at 22:24, Frank Liu <gfrankliu at gmail.com> wrote:
> 
> Hi,
> 
> The doc http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size says size limit is on "Content-Length", but this post https://serverfault.com/questions/871717/nginx-disconnect-when-client-sends-chunked-body-exceeding-desired-size says it also works on chunked encoding. Is that correct? If so, can we update the doc? If not, what is the best way to limit the request size for chunked encoding?

The client_max_body_size directive limits maximum request body size
as specified in the “Content-Length” request header.
Since chunked transfer encoding support introduced for request body
in nginx 1.3.9, the limit instead applies while processing body chunks
if the request body is signalled with "Transfer-Encoding: chunked".
In HTTP/2 (and upcoming HTTP/3) the limit also applies to the actually
processed request body chunks in the corresponding protocols,
if the "Content-Length" request header was not specified in a request.

-- 
Sergey Kandaurov