variable support for client_max_body_size

[Tarek Ziade]

I would like to suggest adding nginx variable support to the client_max_body_size directive.
This would be quite useful to set this value dynamically.

[Valentin V. Bartenev]

Could you provide use cases as well?

[Tarek Ziade]

Sure:

Using HTTPLuaModule, I am calling an external server (a web application firewall app) in a subrequest that will let me know the max body size depending on the query path.

The external app can offer a rich rules-based environment to deal with security, without having to restart and/or reconfigure all our Nginx servers. The values are slightly cached of course so we don't call the WAF server on every request.

[Valentin V. Bartenev]

Any use cases without 3rd-party modules? Your example will not work anyway, because the length is checked before lua code is executed.

[Tarek Ziade]

the length is checked before lua code is executed.

In that case it defeats the purpose for me.

I am a bit confused though as this seemed possible, according to the OpenResty maintainer - ​https://groups.google.com/forum/#!topic/openresty-en/qgSjFSSDVrg

[Yichun Zhang]

ngx_lua does not call the standard nginx request body reader before executing user Lua code. It is up to the user to decide when to actually read the request body (and even how to, the standard request body reader is just one option).

Speaking of the implementation for this feaure in the nginx core, the "complex value" of client_max_body_size can be evaluated at the time of the ngx_http_read_client_request_body call.

[Yichun Zhang]

Ideally, this could be an internal feature on the level of the NGINX C API so that the 3rd-party module can use different limits for different requests on-the-fly. This is much more efficient than the nginx variable approach IMHO.

[nvollmar@…]

One use case without 3rd party modules:

Set client_max_body_size differently depending upon the result of the client certificate verification (allow higher value only when client cert has been verified)