阻止用户将大文件上传到服务器

Question

I'm concerned that someone could cause our server to crash by uploading a very large file to it -- say, 10 gigabytes or more.

Currently, I have a javascript limit set at 10mb, and I also check the size of the file on the server before writing it. That being said, the javascript limit could be easily by-passed by an attacker and the check on the server comes too late -- after the file has been uploaded.

So how could I prevent someone from uploading large files? I'm using rails, nginx and unicorn.

Edit:

In the course of writing this question, I saw some other SO questions on the pop up concerning an nginx setting called client_max_body_size . I'm assuming that simply by setting this I can automatically reject requests from the client over a certain size. Could somebody confirm this?

Answer 1

Yeah, set the max client size in your nginx config. The request will fail with code 413 if too large. Check out the nginx docs for more details.

Edit: Make sure you restart nginx to use the new settings, a command like 'sudo nginx -s reload' would do the trick.