Request Body Size Limit

Learn how to configure the Request Policy Size Limit policy to prevent Denial of Service (DoS) and other types of attacks.

Overview

In NGINX Management Suite API Connectivity Manager (ACM), you can apply global policies to API Gateway and Developer Portal clusters to ensure your organization’s security requirements are enforced.

When you add policies at the environment level, they will apply to all proxies hosted within that environment.

See the Learn about Policies topic for an overview of the different policy types and available policies.


About the Policy

The Request Body Size Limit policy, which by default is set to 1 MB, is applied to all API gateway proxy requests. If the request exceeds this limit, it will be blocked and an error code will be returned. You can adjust the limit to meet your requirements, or you can disable the policy completely by setting the max size to 0.

Intended Audience

This guide is meant for Infrastructure Administrators.

Infrastructure Administrators ensure uniform governance across an organization’s infrastructure by setting policies at the infrastructure level, enabling teams to build APIs without interruption while adhering to the organization’s standards.


Workflow for Applying Policy

To apply the policy or make changes to it, here’s what you need to do:


Policy Settings

Field Type Possible Values Description Required Default
size string Example:
1M or 1K

Sets the maximum body size for client requests.

Megabytes, M, and Kilobytes, K, are the accepted units.

No 1M
returnCode integer In range:
400-599

The error code that is returned to the client when the size of a request exceeds the configured value.

The default error code is 413: Request Entity Too Large.

No 413


Applying the Policy

You can apply this policy using either the web interface or the REST API.


See Also:
You can use tools such as curl or Postman to interact with the NGINX Management Suite API Connectivity Manager REST API. The API URL follows the format https://<NMS_FQDN>/api/acm/<API_VERSION> and must include authentication information with each call. For more information about authentication options, please refer to the API Overview.

To add the Request Body Size Limit policy using the REST API, send an HTTP POST request to the Environments endpoint.

Method Endpoint
POST /infrastructure/workspaces/{workspace}/environments/{environment}
JSON request
{
  "policies": {
    "request-body-size-limit": [
      {
        "action": {
          "returnCode": 413,
          "size": "1M"
        }
      }
    ]
  }
}

This example Request Body Size Limit policy rejects requests exceeding one megabyte and returns error code 413.


To add a Request Body Size Limit policy using the web interface:

  1. Go to the FQDN for your NGINX Management Suite host in a web browser and log in. Then, from the Launchpad menu, select API Connectivity Manager.

  2. On the left menu, select Infrastructure.

  3. Choose the workspace that contains your cluster’s environment from the list of workspaces.

  4. In the Environments section, select the environment name for your cluster.

  5. In the list of clusters, locate the cluster you want to add the policy to. On the Actions menu (represented by an ellipsis, ...), select Edit Advanced Config.

  6. On the left menu, select Global Policies.

  7. Locate the Request Body Size Limit policy in the list of policies. On the Actions menu (represented by an ellipsis, ...), select Add Policy.

  8. On the Request Body Size Limit form, complete the necessary fields:

    • Error code: Specify the error code to return when a request exceeds the maximum size. The default is 413.
    • Request body size: Enter the maximum body size in megabytes or kilobytes. The default is 1 megabyte.
  9. Select Add to apply the policy to the cluster.

  10. Select Save and Submit to deploy the configuration.