Why does Membrane API Gateway return Message is too large?

The limit plugin found a Content-Length header larger than the configured maxBodyLength. The check applies to requests and, if the plugin is in the response flow, to responses.

How do I raise or disable the body size limit in Membrane?

Set maxBodyLength on the limit plugin to a larger number of bytes, or to -1 to disable the limit.

How do I hide the details in Membrane error responses?

Enable production mode by adding a configuration document with production: true to your apis.yaml. Membrane then leaves out detailed information from error responses.

500 Internal Server Error: Message Is Too Large

Membrane API Gateway returns 500 Internal Server Error with the title Message is too large. when the limit plugin finds a message whose Content-Length exceeds maxBodyLength. The check runs in the request flow and in the response flow.

The Error Response

The response contains the status 500 Internal Server Error, the title Message is too large., the detail Message bodies must be smaller than followed by the limit, the problem type https://membrane-api.io/problems/security and a link to this page. The type security means that a security plugin blocked the message. Note that the status is 500, not 413 Payload Too Large. In production mode, the title is replaced by Internal Server Error.

What the Limit Plugin Does

The limit plugin protects the gateway and the backend against oversized messages. It is often placed before plugins that read the whole body into memory, such as validators or sqlInjectionProtection.

api:
  port: 2000
  flow:
    - limit:
        maxBodyLength: 10485760
  target:
    url: https://api.predic8.de

api:
  port: 2000
  flow:
    - limit:
        maxBodyLength: 10485760
  target:
    url: https://api.predic8.de

The limit is given in bytes. The default -1 disables it.

Common Causes

The Client Uploads a Large Body

The request's Content-Length is larger than maxBodyLength. The client is responsible for the size.

The Backend Returns a Large Response

When the limit plugin also applies to the response flow, a backend response larger than the limit is rejected, and the client receives this error instead of the response.

The Limit Is Too Low

maxBodyLength is set lower than the legitimate traffic of the API, for example because file uploads were added later.

How to Fix It

Client: send a smaller body, or split the upload.
Operator: raise maxBodyLength if the traffic is legitimate, or set it to -1 to disable the limit.
Operator: to limit only requests, place the plugin inside a request flow.

Messages without a Content-Length, for example chunked messages, are not rejected with this error. They are cut off while streaming once they exceed the limit.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---.