What happens to request bodies that exceed the Max. Body Size to Process(kB) limit or do not complete in time?

Short answer

If the body exceeds the processable size or has not fully arrived at the moment WAF runs, the body is not parsed; the JSON, XML, form and raw body inspections and the signature scanning in the body are not done, and the decision is left to the Block Unparsed Contents setting on the Raw tab of the page type. If Block unparsed body is selected, a 24-point Block unparsed contents violation occurs, and the request is blocked in the Blocking mode and recorded in the Monitor mode; if Allow Unparsed Body is selected, the body is forwarded to the Backend Service without being inspected. In the Any paths rule, Allow Unparsed Body comes selected. The processable size is the greater of the Max. Body Size to Process(kB) value on the Request Body Limits card (4096 when WAF is turned on) and the Buffer Size(kB) value in the vService limit profile; part of the body is not scanned, the body is either parsed entirely or not at all. The content of an unparsed body is not added to the Event Logs record and to the learning data.

Flow

Step	What happens
1. The body is awaited	While Wait for body for a time is off (default), the whole body is awaited; while it is on, it is awaited for at most the Time to Wait Body time (What is "Wait for body for a time" for?)
2. Raw Body Size	If Structure Checks is on, the body size is compared with the Raw body size limit on the Raw tab; a request that exceeds it gets a violation
3. Parsability	If the body exceeds the processable size or has not completed in the expected time, it is not parsed
4. Decision	Raw → Block Unparsed Contents: if Block unparsed body, a Block unparsed contents violation (24 points); if Allow unparsed body, passing without inspection (What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?)
5. Record	The Event Logs record and the learning record are written without the body content

• Blocked user: In the Blocking mode, the user sees the blocking page; Attack area: Raw · Attack name: Block unparsed contents appears in Event Logs.
• Learning mode: The request is not blocked.
• Not affected: The path, query and header inspections and the signature scanning in them are done even if the body is not parsed.
• Card sentence: The Request Body Limits card shows the limit in the form The first 4 MB of the body is processed for inspection; the first part of a body that exceeds the limit is not scanned, the body is not parsed at all.
• File upload pages: Instead of enlarging the limit for the whole vService, Block Unparsed Contents and Raw Body Size are set for that page on the Raw tab of the page type that receives large uploads; in a body that exceeds the limit, the Allowed Upload Mime Types inspection is not done either. Troubleshooting: Large POST requests are blocked or cut off; why?

Changing the Limit in TR7

1

Adım 1 Open the Request Body Limits window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Request body limits card in the Inspection & Blocking section is clicked.

2

Adım 2 Write the limit

An integer between 1 and 262144 is written in the Max. Body Size to Process(kB) field (e.g. 8192); its counterpart (e.g. 8 MB) appears next to the field. Max. Body Size to Log(kB) cannot be greater than this value (What is the maximum value of Max. body size to process; how does it relate to the log limit?).

3

Adım 3 Save

Edit is clicked; the change is applied without a separate deployment step, but if the Max. Body Size to Process(kB) change modifies the buffer size (when the new or the old value is greater than the Buffer Size(kB) value), the vService is restarted during saving and a short interruption occurs. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

• WEB-CLI: waf options update poolId <vService> --syncWithDefaultFwRules false --bodyParseLimit 8192 (body processing).

Common Misconceptions

• "The first part of a body that does not fit is scanned." There is no partial scanning; the body is either parsed entirely or not at all.
• "A request that exceeds the limit is always blocked." The decision depends on the setting on the Raw tab of the page type; since Allow unparsed body comes selected in the Any paths rule, a body that exceeds the limit passes without inspection by default.
• "If the body is not inspected, the request is not inspected at all." The path, query and header inspections continue to run.
• "Fail-open in the same window lets a body that exceeds the limit through." Only Block Unparsed Contents on the Raw tab determines the fate of a body that exceeds the limit or does not complete; Fail-open is applied only to a request whose scan cannot be completed within the time limit in the Blocking mode (What is the maximum value of Max. body size to process; how does it relate to the log limit?).

How it is done in the documentation

• Request Body Limits · Max. Body Size to Process (kB)
• Raw · Block Unparsed Contents
• vService Limits · Buffer Size(kB)

Related questions

• What is the difference between Block Unparsed Contents and Block Unexpected Parser Errors?
• Large POST requests are blocked or cut off; why?
• What is the maximum value of Max. body size to process; how does it relate to the log limit?