RequestSizeLimit middleware fails to enforce limits on chunked requests
0 reputation · 25 Oct 2021, 18:16 UTC
Problem Overview
When the RequestSizeLimit middleware is configured, Traefik should reject requests whose body size exceeds the specified limit with an HTTP 413 response. However, the middleware’s documentation does not mention handling of Transfer‑Encoding: chunked streams.
Observed Behavior
In both Traefik v2.x and v3.x, a POST request that uses chunked transfer encoding and whose cumulative payload exceeds the configured limit is forwarded to the backend. No 413 error is returned, and Traefik logs do not indicate that the size check was performed.
Constraints & Uncertainty
- The size limit applies to the total body size, not to individual chunks.
- There is no documented configuration option to enable enforcement for chunked bodies.
- Custom error pages are not applied to chunked requests.
Unresolved Questions
- Is there an undocumented flag or future plan to enforce RequestSizeLimit on Transfer‑Encoding: chunked streams?
- What is the intended behavior for oversized chunked requests in upcoming Traefik releases?
- How does Traefik currently handle resource exhaustion when a client sends many small chunks that cumulatively exceed the limit?