ASP.NET Core web.config requestFiltering not overriding applicationhost.config

Question

I'm trying to upload large files to an API controller action in my ASP.NET Core MVC 2.1 application. To that end I've been trying to figure out how to allow this through IIS Express which is how I'm running the application through Visual Studio. As suggested, this should be possible by adding a web.config file to the project root with the following contents:

<?xml version="1.0" encoding="utf-8"?>
<!-- Configuration for IIS integration -->
<configuration>
  <system.webServer>
    <security>
      <requestFiltering>
        <!-- 2 GB -->
        <requestLimits maxAllowedContentLength="2147483647" />
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>

However, this doesn't have any effect as the application just returns HTTP Error 404.13 - Not Found , indicating the request is too large. It seems as if those settings are locked by the IIS so the web.config isn't overriding them. Yes, I'm also using attributes such as [DisableFormValueModelBinding] and [DisableRequestSizeLimit] on the controller action.

Instead I found that it works by adding the same configuration to the site in the applicationhost.config in the \.vs\config folder:

  <location path="MySite">
    <system.webServer>
      <handlers>
        <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModule" resourceType="Unspecified" />
      </handlers>
      <aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="false" startupTimeLimit="3600" requestTimeout="23:00:00" />
      <httpCompression>
        <dynamicTypes>
          <add mimeType="text/event-stream" enabled="false" />
        </dynamicTypes>
      </httpCompression>
      <!-- Everything above this point is auto-generated -->
      <security>
        <requestFiltering>
          <!-- 2 GB -->
          <requestLimits maxAllowedContentLength="2147483647" />
        </requestFiltering>
      </security>
    </system.webServer>
  </location>

This file, however, is not tracked in GIT and it doesn't seem like a good solution to add it to GIT either.

Is there some security reason or other for why the web.config seemingly is not allowed to override the applicationhost.config ? Or is there a solution that I just haven't been able to figure out?

Answer 1

I had a similar issue, I added a web.config with this

<configuration>
  <system.webServer>
    <security>
      <requestFiltering>
        <!-- This will handle requests up to 700MB (CD700) -->
        <requestLimits maxAllowedContentLength="737280000" />
      </requestFiltering>
    </security>
  </system.webServer>][1]][1]
</configuration>

posted too soon. The above solution worked for iis express server but did not for docker. Then I updated the entry

public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
    WebHost.CreateDefaultBuilder(args)
        .UseStartup<Startup>()
        .UseKestrel(options =>
        {
            options.Limits.MaxRequestBodySize = 100000000; //100MB
        });

Then decorate controllers with [RequestSizeLimit(100_000_000)]

Those solutions solved locally and in prod for me.