2

I use Jetty 9.4.8 and i want limits the amount of data that can post to the server. For that i added to jetty.xml:

<Call name="setAttribute">
  <Arg>org.eclipse.jetty.server.Request.maxFormContentSize</Arg>
  <Arg>10000</Arg>
</Call>

I tested jetty like (request-xxlarge.xml - text file(20mb)):

curl -X POST --data @request-xxlarge.xml http://localhost:8080/test -v

As a result i got

*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> POST /test HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.47.0
> Accept: */*
> Content-Length: 21232818
> Content-Type: application/x-www-form-urlencoded
> Expect: 100-continue
> 
< HTTP/1.1 200 OK
< Content-Length: 4
< Connection: close
< Server: Jetty(9.4.8.v20171121)
< 
* Closing connection 0
POST

server processed the request

EDITED

The server returns 413 when Content-Type: application / x-www-form-urlencoded.

But if I expect it to be a web service and i want to process Content-Type: application / soap + xml - then the maxFormContentSize parameter does not work.

How can I limit the size of the body for a web service?

zomac
  • 35
  • 1
  • 5
  • Please show your servlet that is handling the POST request. (also, where you configured this limit in your deployed webapp) – Joakim Erdfelt Mar 12 '18 at 12:48
  • @JoakimErdfelt, my servlet just `resp.getWriter().write("POST\n");` and the limit i set only in jetty.xml. – zomac Mar 13 '18 at 10:00
  • Does your servlet at least it read the POST body content that was sent? using `request.getParts()` or `request.getParameterMap()`? (there's nothing to trigger the limit until you do) – Joakim Erdfelt Mar 13 '18 at 12:43

2 Answers2

5

There are 3 limits that Jetty can impose on request body content based on specific Content-Type values.

Content-Type: application/x-www-form-urlencoded

This is the standard html <form> submission, where the submitted form is accessed via the HttpServletRequest.getParameter(String key) API.

This kind of request body content can be filtered in 2 different ways.

org.eclipse.jetty.server.Request.maxFormContentSize - this is a limit on the overall size (in bytes) of the request body content.

org.eclipse.jetty.server.Request.maxFormKeys - this is a limit on the overall number of form keys of the form being submitted.

The above 2 keys expect integer values, and can be set in any of the following techniques ...

1) As a Server attribute that applies to all deployed webapps

Server.setAttribute("org.eclipse.jetty.server.Request.maxFormContentSize", 100000)

2) As a System Property that applies to all deployed webapps

$ java -Dorg.eclipse.jetty.server.Request.maxFormContentSize=100000 \
       -jar /path/to/jetty-home/start.jar

or

System.setProperty("org.eclipse.jetty.server.Request.maxFormContentSize", "1000000")

3) As a Context parameter on the deployed WebAppContext

In your ${jetty.base}/webapps/<context>.xml you can set these values

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN"
    "http://www.eclipse.org/jetty/configure_9_3.dtd">

<Configure class="org.eclipse.jetty.webapp.WebAppContext">
  <Set name="contextPath">/mycontext</Set>
  <Set name="war"><Property name="jetty.webapps"/>/mycontext.war</Set>

  <Set name="maxFormKeys">100</Set>
  <Set name="maxFormContentSize">202020</Set>
</Configure>

Content-Type: multipart/form-data

This is also a standard form submission as above, but the data can also be accessed via the HttpServletRequest.getPart(String name) APIs.

This kind of data is restricted via the configuration present for the destination Servlet's @MultipartConfig values (or WEB-INF/web.xml entries for the <servlet><multipart-config> elements)

To limit this kind of content type by entire request size, use the maxRequestSize configuration.

All other request Content-Type entries

For all other Content-Type values, the servlet spec, and Jetty are not involved in parsing or limiting the size.

If you are using a library to handle your requests (REST, SOAP, etc) then check with that library to see if it has a mechanism to reject requests based on size, or other reasons (eg: not well-formed, missing expected/required data, etc).

As always, if you want a feature, feel free to request it on the Eclipse Jetty issue tracker at https://github.com/eclipse/jetty.project/issues

Joakim Erdfelt
  • 46,896
  • 7
  • 86
  • 136
  • I submitted an enhancement request to make those be able to be set from `WEB-INF/web.xml` too - https://github.com/eclipse/jetty.project/issues/2325 – Joakim Erdfelt Mar 13 '18 at 14:34
0

Not sure what your issue is, but I'll give it a shot.

###Theory### The Expect: 100-continue header is specified in HTTP 1.1 and allows the server to acknowledge or reject a POST/PUT request immediately after the headers are send but before the client starts sending potentially large amounts of actual data (body of the request). Thus, a conforming client must then wait for a HTTP/1.1 100 Continue before sending the data. This scheme is advantageous for larger POST/PUT requests since in the case of rejection the client and server don't waste their time with superfluous network communication.

###Possible Solutions###

  1. Disable Expect Logic

    curl -H 'Expect:' -H 'Transfer-Encoding: ...' -H 'Content-Type: ...'
    --data-binary '@mediumfile' example.com/path -v

  2. Send next packet with the big file as expected after the first response packet.

More info here : https://www.rfc-editor.org/rfc/rfc7231#section-5.1.1

Community
  • 1
  • 1
YetAnotherBot
  • 1,937
  • 2
  • 25
  • 32