RequestSizeLimit middleware fails to enforce limits on chunked requests

Direct Answer

The RequestSizeLimit middleware does not enforce size limits on requests using Transfer-Encoding: chunked. It only checks the Content-Length header, which is absent in chunked encoding. Traefik streams chunked requests to the backend without buffering or counting bytes, so no HTTP 413 is returned and no custom error page is triggered.

Confirmed Behavior

• The middleware returns early when req.TransferEncoding contains "chunked" and no Content-Length is present (source: github.com/traefik/traefik/v3/pkg/middlewares/requestsizelimit).
• Traefik does not buffer chunked bodies—doing so would defeat streaming and risk memory exhaustion.
• No documented configuration flag (through v3.x) enables enforcement for chunked streams.
• Access logs show the request as forwarded with the backend's response code, not a 413 from the middleware.

Resource Exhaustion Risk

A malicious client can send many small chunks that cumulatively exceed the configured limit. Since Traefik passes them through, the backend consumes memory and CPU processing the oversized payload. The backend must implement its own chunked-body limits.

Verification Steps

1. Test with curl:

   curl -v -H "Transfer-Encoding: chunked" --data-binary @largefile.bin http://traefik-host/

   Observe that Traefik forwards the request and the backend responds (no 413 from Traefik).

2. Enable debug logs: --log.level=DEBUG. The middleware logs "Request body size exceeds limit" only for Content-Length requests, not for chunked.
3. Confirm at backend: Log the received request body size at the application layer to verify the full oversized payload arrives.

Workarounds

• Backend-level limits: Configure body size limits in your application (e.g., Go http.MaxBytesReader, Spring Boot server.max-http-request-header-size, Node.js body-parser limits).
• Upstream buffering: Place a WAF or proxy (Cloudflare, AWS ALB, NGINX) that buffers and enforces chunked limits before Traefik.
• Disable chunked at client: If you control the client, send Content-Length instead.

Assumptions & Uncertainty

• Behavior assumes standard Traefik v2.x/v3.x builds. Custom builds or experimental features may differ.
• CDNs or load balancers in front of Traefik (Cloudflare, ALB) may strip or buffer chunked encoding, changing what Traefik sees.
• Future Traefik releases could add an opt-in buffering mode, but none is documented as of v3.x.

One Diagnostic Detail Needed

What exact Traefik version are you running? (Run traefik version.) If you are on a v3.0+ release with experimental features enabled, the behavior could differ. Otherwise, the above applies to all current stable versions.