[Bug]: requestLengthDiskThreshold is incorrectly configured.

[dimarobert]

Is there an existing issue for this?

• I have searched the existing issues

What happened?

The default configuration for requestLengthDiskThreshold in web.config is using a value of 81920, which translates to 80MB, while the maxRequestLength is 28672, which translates to 28MB.
The default value from .net is 80 (as in 80KB). source

In the same source provided above, there is also a RequestLengthDiskThresholdBytes property. This property is the one used by HttpRequest class to create its internal content buffer, which then gets used by HttpRequest.InputStream.

I also looked at the values in Immediate Window, and these were the values:

> System.Web.Configuration.RuntimeConfig.GetConfig(System.Web.HttpContext.Current).HttpRuntime
{System.Web.Configuration.HttpRuntimeSection}
    AllowDynamicModuleRegistration: true
    ApartmentThreading: false
    AppRequestQueueLimit: 5000
    AsyncPreloadMode: None
    CurrentConfiguration: null
    DefaultRegexMatchTimeout: {00:00:00}
    DelayNotificationTimeout: {00:00:00}
    ElementInformation: {System.Configuration.ElementInformation}
    ElementProperty: {System.Configuration.ConfigurationElementProperty}
    Enable: true
    EnableHeaderChecking: true
    EnableKernelOutputCache: true
    EnableVersionHeader: false
    EncoderType: "System.Web.Util.HttpEncoder"
    EvaluationContext: {System.Configuration.ContextInformation}
    ExecutionTimeout: {00:20:00}
    FcnMode: Single
    HasContext: true
    LockAllAttributesExcept: {System.Configuration.ConfigurationLockCollection}
    LockAllElementsExcept: {System.Configuration.ConfigurationLockCollection}
    LockAttributes: {System.Configuration.ConfigurationLockCollection}
    LockElements: {System.Configuration.ConfigurationLockCollection}
    LockItem: false
    MaxQueryStringLength: 2048
    MaxRequestLength: 28672
    MaxUrlLength: 2048
    MaxWaitChangeNotification: 0
    MinFreeThreads: 8
    MinLocalRequestFreeThreads: 4
    Properties: {System.Configuration.ConfigurationPropertyCollection}
    RelaxedUrlToFileSystemMapping: false
    RequestLengthDiskThreshold: 81920
    RequestPathInvalidCharacters: "<,>,*,%,:,\\,?"
    RequestValidationMode: {2.0}
    RequestValidationType: "System.Web.Util.RequestValidator"
    RequireRootedSaveAsPath: true
    SectionInformation: {System.Configuration.SectionInformation}
    SendCacheControlHeader: true
    ShutdownTimeout: {00:02:00}
    TargetFramework: "4.7.2"
    UseFullyQualifiedRedirectUrl: true
    WaitChangeNotification: 0

> System.Web.Configuration.RuntimeConfig.GetConfig(System.Web.HttpContext.Current).HttpRuntime.RequestLengthDiskThresholdBytes
83886080

Looks like when loading the values from web.config, the xml deserialization that creates the System.Web.Configuration.HttpRuntimeSection instance does not hit the validation that is part of the RequestLengthDiskThreshold property setter, but if I try to set the value to the one from web.config through Immediate Window I get the intended validation exception:

System.Web.Configuration.RuntimeConfig.GetConfig(System.Web.HttpContext.Current).HttpRuntime.RequestLengthDiskThreshold = 81920
'System.Web.Configuration.RuntimeConfig.GetConfig(System.Web.HttpContext.Current).HttpRuntime.RequestLengthDiskThreshold = 81920' threw an exception of type 'System.Configuration.ConfigurationErrorsException'
    BareMessage: "The property 'RequestLengthDiskThreshold' must be less than or equal to the 'MaxRequestLength' property."
    Data: {System.Collections.ListDictionaryInternal}
    Errors: {System.Configuration.ConfigurationException[1]}
    Filename: "D:\\wwwroot\\site\\web.config"
    HResult: -2146232062
    HelpLink: null
    InnerException: null
    Line: 164
    Message: "The property 'RequestLengthDiskThreshold' must be less than or equal to the 'MaxRequestLength' property. (D:\\wwwroot\\site\\web.config line 164)"
    Source: "System.Web"
    StackTrace: null
    TargetSite: null

another proof, a request with 1.2MB content with _data in memory and no _file created and the same value for _fileThreshold

Steps to reproduce?

none

Current Behavior

No response

Expected Behavior

No response

Relevant log output

Anything else?

A related discussion took place in #5778 and associated PR.

Affected Versions

10.1.2 (latest v10 release)

What browsers are you seeing the problem on?

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[mitchelsellers]

I don't believe this is correct, or I guess I'm unsure of what is being requested here.

The default requestLengthDiskThreshold is 81920, which is a value in bytes = (80kb) = which matches the Microsoft defaults
The default maxRequestLength is 28672, which is a value in kilobytes = 28 Mb = Which is larger than the Microsoft default value of 4mb or 4096

The purpose of the requestLenghtDiskThreshold is used to prevent a DDOS attack, and really it shouldn't be upped when we make the larger files as its the threshold of when IIS starts to use disk for caching.

So I guess my question here is, what is requested to be changed?

[dimarobert]

@mitchelsellers The request / issue is that 81920 for requestLengthDiskThreshold is not in fact 80KB, but instead 80MB as proven by the references in the .net referencesource code, the tests/debugging done using Immediate Window, and the screenshot where for a 1.2MB request (considerably larger that the 80KB that should be the requestLengthDiskThreshold) the data was not swapped by .net to disk and it is still in memory.

further proof, I changed maxRequestLength to 110000 and system.webServer/security/requestFiltering/requestLimits/@maxAllowedContentLength to 112640000 to allow requests up to ~110MB and then I tried uploading two files a 78MB one and a 81MB one.
Note: requestLengthDiskThreshold is still at the original value of 81920.

result when uploading 78MB file - no temporary file created, data is in memory:

result when uploading 81MB file - the temporary file gets created:

notice that the _data buffer in memory stops at 83886080 (which is 81920 * 1024) while the Length of the temp file on disk is 84935401, the entire request size.

Small powershell script to generate arbitrary size files for testing

generated with AI

param(
    [Parameter(Mandatory = $true)]
    [string]$FileName,

    [Parameter(Mandatory = $true)]
    [int]$SizeKB
)

[long]$bytesRemaining = $SizeKB * 1024
[long]$chunkSize = 4096   # 4 KB chunks
$rand = New-Object System.Security.Cryptography.RNGCryptoServiceProvider

$fs = [System.IO.File]::OpenWrite($FileName)

try {
    while ($bytesRemaining -gt 0) {
        $bytesToWrite = [Math]::Min($chunkSize, $bytesRemaining)
        $buffer = New-Object byte[] $bytesToWrite
        $rand.GetBytes($buffer)
        $fs.Write($buffer, 0, $bytesToWrite)
        $bytesRemaining -= $bytesToWrite
    }
}
finally {
    $fs.Close()
}

Write-Host "File '$FileName' created with size $SizeKB KB."

[mitchelsellers]

Thanks for the extra detail I found the discrepancy, I'm going to get with the approver team to get this updated as quickly as we can.

Additionally I've submitted a PR to Microsoft to correct the documentation - dotnet/dotnet-api-docs#12084

[jeremy-farrance]

The MS docs have been wrong for years. I did not realize I knew someone who could get them updated. I reported it years ago and just kinda shrugged when it got no attention.

For our own use we maintain a page with working details on this stuff.
https://accu2025.accuraty.us/DNN/DNN-Large-File-Upload-Config-Changes