Can I block large requests (e.g. above a certain size)?

Short answer

Yes. If WAF is enabled, in the RAW tab of the page type, the Raw Body Size restriction counts requests whose request body size declared in the Content-Length header exceeds the limit as violations and blocks them in Blocking Mode. If there is no WAF, the Content-Length header is compared with a byte threshold with Dynamic Condition using the Integer greater than operator, and the condition is bound to the Block action (Status code 413). The Request Size (bytes) condition measures only the first part of the request (the header block and the buffered part of the body); it is used against inflated headers, not for a file size limit.

Problem: Oversized Requests Strain the Backend Service

Very large file uploads and inflated request bodies consume the memory and bandwidth of the Backend Service; some attacks slow the service down this way. Requests above the size the application accepts are wanted to be stopped at TR7.

Solution: Four Methods

Methods 1 and 2 limit the body size and are alternatives to each other; Method 3 is used separately for the header block; Method 4 is the command-line equivalent of Method 2.

Your situation	Suitable method
I have a WAF license; a body size limit	Method 1: WAF → Raw Body Size
No WAF; an exact byte limit for the body size	Method 2: Dynamic condition (Content-Length) + Block
Abnormally large header blocks	Method 3: Request Size (bytes) + Block
Setting up Method 2 from the command line	Method 4: WEB-CLI

Method 1: WAF → Raw Body Size Recommended

• How it works The check compares the declared body size (Content-Length) with the restriction on every request that carries a body, regardless of the content type, and before all body checks; a request that does not comply with the restriction is scored as a Raw Body Size violation in the Structure Limits category. Requests without a body do not enter this check.
• Where it is opened Left Monitor Panel → WAF-Protected vServices → vService → WAF Management → Page Types → rule → RAW tab
• Requirement WAF license; a WAF-enabled HTTP vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Enable WAF (if needed)

If WAF is not on in the vService, the HTTP vService is edited, the WAF box under Details is checked, and the form is saved with Save; details: How do I attach WAF, L7 DDoS & Threat Protection and AGS to a vService?

2

Adım 2 Open the RAW rule

In the WAF Management tab, the rule is opened from the Page Types list (Any paths for the whole site, the related path for a single upload endpoint); in the RAW tab, Add Common Rule for Raw (Edit common rule for Raw if the rule exists) is clicked.

3

Adım 3 Enter the limit

In the Raw Body Size field, Less than or Equal to is selected and the byte value (e.g. 10485760 for 10 MB) is entered. For bodies that do not fit in the inspection buffer, Block Unparsed Contents can also be turned on.

4

Adım 4 Save the rule

The form is saved with Add.

5

Adım 5 Set the WAF mode to Blocking (if needed)

In the WAF Management tab, WAF Mode = Blocking Mode is selected with the Edit button of the mode card and saved (WAF mode Edit screen). WAF starts in Learning mode; in Learning and Monitor modes, the request is not blocked, only recorded.

Verification

1Large requestClient side

Command: curl -s -o /dev/null -w '%{http_code}' -X POST --data-binary @buyuk.bin https://www.example.com/upload

ExpectedWAF blocking status code (default 418)

2WAF event recordTR7 side

The WAF-Protected vServices → vService → Event Logs screen is checked.

ExpectedRaw Body Size violation, Attack blocked

Method 2: Dynamic Condition (Content-Length) + Block

• How it worksDynamic Condition reads the value in the Content-Length header of the request as a number and compares it with the byte threshold with Integer greater than; a request that exceeds the threshold receives a 413 response with Block and is not forwarded to the Backend Service.
• Where it is openedLoad Balancer → Conditions → Dynamic Condition · Load Balancer → Actions → Block
• Requirement None
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the condition form

The condition form is opened with Load Balancer → Conditions → Add (how to add).

2

Adım 2 Define the condition

Condition Name = buyuk-govde and Criteria = Dynamic Condition are selected; Condition Level = On Request and Condition Protocol = HTTP are left as they are (neither can be changed after saving). In the Query Key field, the Request HTTP header content variable is selected with fx with the Content-Length argument; Operator = Integer greater than and Integer to compare = 10485760 (10 MB) are entered.

3

Adım 3 Save the condition

The condition is saved with Add.

4

Adım 4 Open the action form

The action form is opened with Load Balancer → Actions → Add.

5

Adım 5 Define the Block action

Action Name = buyuk-istek and Action Type = Block are selected; Execution Level is left at the default On request and Deny Type at the default Standard, and Status Code = 413 is selected (default 403).

6

Adım 6 Bind the condition

buyuk-govde is selected in the Conditions field. If the limit is to be applied only to a specific upload path, a Path condition is added in the same group with and.

7

Adım 7 Save the action

The action is saved with Add.

8

Adım 8 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and the edit form is opened with Edit.

9

Adım 9 Add the action to the vService

buyuk-istek is selected in the Details → Actions field. The action does not work unless it is added to the vService.

10

Adım 10 Save

The form is saved with Save. In a cluster, the change is transferred to the peer device automatically by default; if Manual Sync Mode is on, it is sent with Synchronize.

Verification

1Large requestClient side

Command: head -c 11000000 /dev/zero > buyuk.bin; curl -s -o /dev/null -w '%{http_code}' -X POST --data-binary @buyuk.bin https://www.example.com/upload

Expected413

2Small requestClient side

A file below the threshold is sent with the same command.

ExpectedThe normal response of the application (e.g. 200)

Method 3: Request Size (bytes) + Block

• How it works The condition measures the byte length of the first part of the request that reaches TR7 (the header block and the part of the body buffered up to that moment). It does not see the total size of the body or the Content-Length header; for this reason, it is used against abnormally large header blocks.
• Where it is openedLoad Balancer → Conditions → Request Size (bytes)
• Requirement None
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the condition form

The condition form is opened with Load Balancer → Conditions → Add.

2

Adım 2 Define the condition

Condition Name = buyuk-baslik, Criteria = Request Size (bytes), Operator = Greater than (>) and the value 16384 are entered (Request Size (bytes) · Scenario 1: Blocking Abnormally Large Requests). Since the measured value is limited by the buffer size of the vService, thresholds at the megabyte level do not match in this condition.

3

Adım 3 Save the condition

The condition is saved with Add.

4

Adım 4 Create the Block action and add it to the vService

Steps 4–10 of Method 2 are applied; buyuk-baslik is selected in the Conditions field and Status Code = 413 is used.

Verification

1Large headerClient side

Command: curl -s -o /dev/null -w '%{http_code}' -H "X-Test: $(head -c 20000 /dev/zero | tr '\0' a)" https://www.example.com/

Expected413

Method 4: WEB-CLI

• How it works The Dynamic condition and the Block action in Method 2 are created with lb condition / lb action, and the action is added to the vService with lb service.
• Where it is opened TR7 WEB-CLI → lb condition · lb action · lb service
• Requirement WEB-CLI access
• vService type HTTP

Step-by-Step Configuration

WEB-CLI runs each line as a separate command; commands are written on a single line.

1

Adım 1 Create the condition

smartCond = Dynamic condition, intGt = Integer greater than; %REQHEADER(Content-Length) = Request HTTP header content (Content-Length). The variable is written inside single quotes (dynamic conditions).

lb condition add criteria smartCond smartVar '%REQHEADER(Content-Length)' smartOperator intGt smartIntRefValue 10485760 --name buyuk-govde

2

Adım 2 Get the condition ID

The --cond field of the action requires the ID of the condition, not its name. lb condition add gives no output when it succeeds; the ID is seen in the id column of the list below (it starts with lbConditions-).

lb condition list

3

Adım 3 Create the Block action

Blocking actions:

lb action add type deny name buyuk-istek --denyStatusCode 413 --cond <large-body-id>

4

Adım 4 See the existing actions

The rules.0, rules.1… lines show the actions bound to the vService.

lb service show <vService>

5

Adım 5 Add the action to the vService

The new action is written to the first empty index, that is, to the number of existing actions. In the example, since the vService has two actions (rules.0, rules.1), --rules.2 is used; writing to a filled index replaces the action there.

lb service update id <vService> --rules.2 buyuk-istek

Verification

1Large requestClient side

The curl test in Method 2 is repeated.

Expected413

Common Mistakes

• Trying to limit the upload size with Request size (bytes). This condition measures only the first part of the request; it does not see the total of the body.
• Mistaking Buffer size for an upper limit. The Buffer Size in vService Limits does not limit large files (What is Buffer size used for; when should I change it?).
• Forgetting requests that do not carry Content-Length. Bodies sent in parts (chunked) have no Content-Length header; the condition of Method 2 does not match these requests.
• Leaving WAF in Learning or Monitor mode and expecting blocking. A Raw Body Size violation is blocked only in Blocking mode.
• Writing the condition name in the --cond field. In WEB-CLI, --cond expects the condition ID; if the name is written, the action is bound to a condition that does not exist.

How it is done in the documentation

• RAW · Raw Body Size
• Dynamic Condition · Operator
• Request Size (bytes) · Operator
• Block · Status Code

Related questions

• Large file uploads fail; why?
• What is Buffer size used for; when should I change it?
• Can I look for and block specific content in the request body (JSON / XML / form)?