Configuring maximum HTTP body size with ASP.NET Core Kestrel

When a client sends a large JSON payload or a file is uploaded, the Kestrel web server protects itself by rejecting requests that exceed its configured size limit. In ASP.NET Core 2, you can adjust this per request or globally.

To set a global limit in Program.cs (or Startup.cs), use the following code:

public static IWebHost BuildWebHost(string[] args) =>
    WebHost.CreateDefaultBuilder(args)
        .UseKestrel(options =>
        {
            options.Limits.MaxRequestBodySize = 50 * 1024 * 1024; // 50 MB
        })
        .UseStartup<Startup>()
        .Build();

For controller or action-specific limits, use the [RequestSizeLimit] attribute:

[RequestSizeLimit(104857600)] // 100 MB
[HttpPost("upload")]
public IActionResult UploadFile(IFormFile file)
{
    ...
}

To allow unlimited size (for example, when the limit is enforced by a reverse proxy), set:

options.Limits.MaxRequestBodySize = null;

Keep in mind that large request bodies consume memory and may cause long blocking reads, so set practical limits and prefer streaming for big uploads.