IIS7 - Security

Re: Changing maxAllowedContentLength

mbarga1 — Mon, 19 Oct 2009 18:54:49 GMT

I'm trying to load an app on a site for a server I just converted over from Windows 2003 to Windows 2008, I have tried changing this but I keep getting the same error.

http://www.element-it.com/RequestFilteringModule-maxAllowedContentLength.aspx

"The request filtering module is configured to deny a request that exceeds the request content length"

The documentation from Microsoft says to change Applicationhost.config file but the file on my server doesn't even have the record which would make it work. The Web.Config file is set correctly there is nothing to change but it still will not let me upload more then 30 megs.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;295626

Any thoughts?

Re: Changing maxAllowedContentLength

steve schofield — Thu, 02 Apr 2009 12:08:01 GMT

Funny I just ran across this post and agree making the error more descriptive would help troubleshooting.

Re: Changing maxAllowedContentLength

gcinseattle — Mon, 18 Aug 2008 17:08:44 GMT

Also,

With respect to this limit can anyone imagine a way to change the error returned from IIS from the very vague "HTTP Error 404.13 - Not Found" to something more relevant to the actual upload size error that actually occurs?

Re: Changing maxAllowedContentLength

skumar2003 — Mon, 22 Jan 2007 23:13:25 GMT

Ok, I see that appCmd.exe modifies the applications web.config file with the required entries. Great, this is what I was looking for.

Thank you for your help.

Shiv.

Re: Changing maxAllowedContentLength

skumar2003 — Mon, 22 Jan 2007 23:07:46 GMT

Thomas,

I tried your suggestion and eventually got it working but have another question.

What is the "unit of measure" for the maxAllowedContentLength attribute? In ASP.NET Web.config

maxRequestLength is in KB. It looks like the maxAllowedContentLength is in bytes?

Now in order to get your suggestion to work I had to modify the overrideModeDefault from "Deny" to "Allow" like so:

I'm assuming this change allows for "application level" control? If so, can I not add my setting to the web.config file of the application in question?

I had to "Allow

Re: Changing maxAllowedContentLength

skumar2003 — Mon, 22 Jan 2007 22:49:34 GMT

Thomas,

Thank you for your quick reply! I'll try your suggestion...

Is there a GUI that I can use to set this or config file local to my application that I can create in order to set this?

Shiv.

Re: Changing maxAllowedContentLength

thomad — Mon, 22 Jan 2007 22:38:28 GMT

Try this:

%windir%\system32\inetsrv\appcmd set config -section:requestFiltering -requestLim
its.maxAllowedContentLength:1000000

or if you only want to set it for your app:

%windir%\system32\inetsrv\appcmd set config "Default Web Site/<your app>" -section:requestFiltering -requestLimits.maxAllowedContentLength:1000000

Hope this helps

Changing maxAllowedContentLength

skumar2003 — Mon, 22 Jan 2007 22:22:05 GMT

I'm using VS.NET 2005 running on Vista.

The issue pertains to being able to upload large files in an ASP.NET application when using IIS 7.0 (and not when using the development webserver).

My Web.config file for my application I have:

maxRequestLength="2097151" (the maximum allowed).

However when uploading large files (I've tried with a 60MB file) I get this error from IIS 7.0:

_________________________________________________________________________________________

HTTP Error 404.13 - Not Found

Description: The request filtering module is configured to deny a request that exceeds the request content length.

Error Code: 0x00000000

Notification: BeginRequest

Module: RequestFilteringModule

What you can try:

Verify the configuration/system.webServer/security/requestFiltering/requestLimits@maxAllowedContentLength setting in the applicationhost.config or web.config file.

More Information... This is a security feature. Do not change this feature unless the scope of the change is fully understood. You can configure the IIS 7.0 server to reject requests whose content length is greater than a specified value. If the request's content length is greater than the configured length, this error is returned. If the content length requires an increase, modify the configuration/system.webServer/security/requestFiltering/requestLimits@maxAllowedContentLength setting.

_________________________________________________________________________________________

I've never changed any setting in IIS 7.0 and so would appreciate it if someone can tell me how to change this setting.

But more importantly, it seems that with IIS 7.0 we're now going to have to synchronize such settings in two places? Is that correct?

Thanks in advance for any help.

Shiv