How to use MaxRequestBodySize in ASP.NET Core on IIS with maxAllowedContentLength?

Question

I have an ASP.NET Core web API running on IIS. In an operation, I set IHttpMaxRequestBodySizeFeature.MaxRequestBodySize to 262144000. I have used the IIS Configuration Editor to

• modify ApplicationHost.config for my site by setting system.webServer/security/requestFiltering/requestLimits/maxAllowedContentLength to 4294967295
• modify ApplicationHost.config for my site by setting system.webServer/serverRuntime/maxRequestEntityAllowed to 4294967295
• modify Root Web.config for my site by setting system.web/httpRuntime/maxRequestLength to 2147483647

Those are the values I also see when I choose Web.config in the IIS Configuration Editor.

The site is behind another IIS site acting as a reverse proxy. I have made the same changes there.

I am able to upload files larger than the default ~30MB limit, but I consistently get the following warning whenever I set IHttpMaxRequestBodySizeFeature.MaxRequestBodySize to a large value:

Increasing the MaxRequestBodySize conflicts with the max value for IIS limit maxAllowedContentLength. HTTP requests that have a content-length greater than maxAllowedContentLength will still be rejected by IIS. You can disable the limit by either removing or setting the maxAllowedContentLength value to a higher limit.

I have even looked at the ASP.NET source code to verify that the warning only prints if you're trying to set the limit higher than the IIS settings ([1], [2]).

What am I doing wrong?

If it's relevant, I am publishing to IIS using Azure Pipelines. My repo does not contain a web.config, but for good measure I tried with the following web.config without luck:

<configuration>
  <system.web>
    <httpRuntime maxRequestLength="2147483647" />
  </system.web>
  <system.webServer>
    <security>
      <requestFiltering>
        <requestLimits maxAllowedContentLength="4294967295" />
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>

Answer 1

Turns out there are several bugs in ASP.NET Core when setting the limits to values above Int32.MaxValue. Furthermore, the limit must be set in two places. See this issue and linked issues. In summary:

• Set the web.config value system.webServer.security.requestFiltering.maxAllowedContentLength to Int32.MaxValue
• In the app startup, set IISServerOptions.MaxRequestBodySize to Int32.MaxValue

That removes the warning (and of course limits requests to ~2GB).