Apache LimitRequestBody not taking effect when using ProxyPass

I'm developing an application with Django and I'm using gunicorn and apache to deploy it. The application allows submitting images as a multipart form.

I have put in place a mechanism to limit the size of the image and the dimension at Django level. I would like to limit the file size that are passed to Django at Apache level.

Images are stored and retrieved with Django, so apache is not serving nor storing these uploaded images.

This is the apache configuration:

<VirtualHost *:443>
    ServerName myserver.com
    ServerAdmin email@example.com

    # limit size of the body to 10mb
    LimitRequestBody 10485760

    Alias "/static" "/path/to/static/"
    <Directory /path/to/static/>
            Require all granted
    </Directory>
    ProxyPass /static !

    # set this header to allow gunicorn to know if request is https or not
    RequestHeader set X_FORWARDED_PROTO 'https' env=HTTPS

    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:8500/ 
    ProxyPassReverse / http://127.0.0.1:8500/


    SSLEngine on
    SSLCertificateFile /path/to/certificate.pem
    SSLCertificateKeyFile /path/to/privatekey.pem


    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %{ms}T" combined_with_time
    CustomLog ${APACHE_LOG_DIR}/path/to/logs/access.log combined_with_time
    ErrorLog ${APACHE_LOG_DIR}/path/to/logs/error.log
</VirtualHost>

With the apache configuration provided, I would expect that uploading a file bigger than 10mb (I'm using a file of about 200mb to test things) apache would return a 413 Request Entity Too Large. But the file is reaching my server on http://127.0.0.1:8500/, because Django is handling the response.

As far as I understand, the documentation https://httpd.apache.org/docs/2.4/mod/core.html#limitrequestbody do not say anything about files, so I supposed that this limit will affect file uploading.

This post https://stackoverflow.com/questions/16439722/apache-limitrequestbody-no-effect-on-ssl-binary-data sais that LimitRequestBody does not apply to proxied request in version 2.2, but this limitation was removed in apache 2.4 which is the version I'm using.

Back to Top