Error pushing huge packages on IIS (413 Payload Too Large)

I’m unable to push huge packages on BaGet installed on IIS. It seems related to #88.

I didn’t figure out by trial and error the maximum allowable size. I’m able to reproduce the bug with packages of at least 41mb.

Push command:

C:\> nuget.exe push -source http://myserver:5000/v3/index.json MyHugePackage.nupkg
AVERTISSEMENT : No API Key was provided and no API Key could be found for 'http://myserver:5000/api/v2/package'. To save an API Key for a source use the 'setApiKey' command.
Pushing MyHugePackage.nupkg to 'http://myserver:5000/api/v2/package'...
  PUT http://myserver:5000/api/v2/package/
  RequestEntityTooLarge http://myserver:5000/api/v2/package/ 25948ms
Le code d'état de réponse n'indique pas la réussite : 413 (Payload Too Large).

Output from the log file:

fail: Microsoft.AspNetCore.Server.IIS.Core.IISHttpServer[3]

      Unexpected exception in "IISHttpContext.ReadBody".

Microsoft.AspNetCore.Server.IIS.BadHttpRequestException: Request body too large.

   at Microsoft.AspNetCore.Server.IIS.BadHttpRequestException.Throw(RequestRejectionReason reason)

   at Microsoft.AspNetCore.Server.IIS.Core.IISHttpContext.ReadBody()

fail: Microsoft.AspNetCore.Server.IIS.Core.IISHttpServer[2]

      Connection ID "18086456109425492159", Request ID "800000c0-0001-fb00-b63f-84710c7967bb": An unhandled exception was thrown by the application.

Microsoft.AspNetCore.Server.IIS.BadHttpRequestException: Request body too large.

   at Microsoft.AspNetCore.Server.IIS.BadHttpRequestException.Throw(RequestRejectionReason reason)

   at Microsoft.AspNetCore.Server.IIS.Core.IISHttpContext.ReadBody()

   at System.IO.Pipelines.PipeCompletion.ThrowLatchedException()

   at System.IO.Pipelines.Pipe.GetReadResult(ReadResult& result)

   at System.IO.Pipelines.Pipe.GetReadAsyncResult()

   at Microsoft.AspNetCore.Server.IIS.Core.IISHttpContext.ReadAsync(Memory`1 memory, CancellationToken cancellationToken)

   at Microsoft.AspNetCore.Server.IIS.Core.HttpRequestStream.ReadAsyncInternal(Memory`1 buffer, CancellationToken cancellationToken)

   at Microsoft.AspNetCore.WebUtilities.BufferedReadStream.EnsureBufferedAsync(Int32 minCount, CancellationToken cancellationToken)

   at Microsoft.AspNetCore.WebUtilities.MultipartReaderStream.ReadAsync(Byte[] buffer, Int32 offset, Int32 count, CancellationToken cancellationToken)

   at Microsoft.AspNetCore.WebUtilities.FileBufferingReadStream.ReadAsync(Byte[] buffer, Int32 offset, Int32 count, CancellationToken cancellationToken)

   at Microsoft.AspNetCore.WebUtilities.StreamHelperExtensions.DrainAsync(Stream stream, ArrayPool`1 bytePool, Nullable`1 limit, CancellationToken cancellationToken)

   at Microsoft.AspNetCore.Http.Features.FormFeature.InnerReadFormAsync(CancellationToken cancellationToken)

   at Microsoft.AspNetCore.Mvc.ModelBinding.FormValueProviderFactory.AddValueProviderAsync(ValueProviderFactoryContext context)

   at Microsoft.AspNetCore.Mvc.ModelBinding.CompositeValueProvider.CreateAsync(ActionContext actionContext, IList`1 factories)

   at Microsoft.AspNetCore.Mvc.ModelBinding.CompositeValueProvider.TryCreateAsync(ActionContext actionContext, IList`1 factories)

   at Microsoft.AspNetCore.Mvc.Controllers.ControllerBinderDelegateProvider.<>c__DisplayClass0_0.<<CreateBinderDelegate>g__Bind|0>d.MoveNext()

--- End of stack trace from previous location where exception was thrown ---

   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeInnerFilterAsync>g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)

   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeFilterPipelineAsync>g__Awaited|19_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)

   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker)

   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)

   at BaGet.OperationCancelledMiddleware.Invoke(HttpContext context) in D:\a\1\s\src\BaGet.Core.Server\OperationCancelledMiddleware.cs:line 28

   at Microsoft.AspNetCore.Server.IIS.Core.IISHttpContextOfT`1.ProcessRequestAsync()

I installed BaGet on IIS as detailed in the documentation (Windows IIS Proxy)

I also increase all the size limits I found:

web.config

<system.webServer>
  <security>
    <requestFiltering>
      <requestLimits maxAllowedContentLength="2147483647" maxQueryString="4096" />
    </requestFiltering>
  </security>
</system.webServer>

<system.web>
  <httpRuntime maxRequestLength="2147483647" />
</system.web>

<system.serviceModel>
  <bindings>
    <basicHttpBinding>
      <binding maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647" maxBufferSize="2147483647" transferMode="Streamed">
        <readerQuotas maxBytesPerRead="2147483647" maxStringContentLength="2147483647‬" />
      </binding>	
    </basicHttpBinding>
  </bindings>	
</system.serviceModel>

applicationHost.config

<location path="BaGet server">
  <system.webServer>
    <serverRuntime maxRequestEntityAllowed="2147483647" uploadReadAheadSize="2147483647" />
  </system.webServer>
</location>

[RichardSinden]

It’s limited to 30MB (https://github.com/aspnet/Announcements/issues/267). I was having exactly the same issue and I couldn’t find any way to change this in configuration without a code change. So I’ve created this PR to make it configurable in the appsettings.json.

As you pointed out this was addressed for Kestrel in https://github.com/loic-sharma/BaGet/issues/88 (code below), but it seems to be fixed to 30MB for IIS. Given that the intention was to allow the limit to be enforced in IIS, then I made it configurable rather than just setting it to null for IIS as well.

.ConfigureKestrel(options =>
{
    // Remove the upload limit from Kestrel. If needed, an upload limit can
    // be enforced by a reverse proxy server, like IIS.
    options.Limits.MaxRequestBodySize = null;
})

[RichardSinden]

This setting seems to match what is configured in <requestFiltering> in the web.config, as above, but it doesn’t seem to do anything in this case.

<system.webServer>
  <security>
    <requestFiltering>
      <requestLimits maxAllowedContentLength="2147483647" maxQueryString="4096" />
    </requestFiltering>
  </security>
</system.webServer>