Uploading files past Asp.net request length limit?

Question

I searched SO and found this question, but it's not quite what I'm asking. I'm wondering if a IHttpModule can be created that can inspect the ContentLength of the request, and if so either redirect or somehow throw that request out and create a new one.

Specifically, I'm trying to handle image file uploads, but I'd like to have the request continue on to the upload page with some kind of warning, rather than a flat error page. I have this bit of code that gets hit with a large request:

    private void context_BeginRequest(object sender, EventArgs e)
    {
        HttpApplication application = (HttpApplication)sender;
        HttpContext context = application.Context;

        if (context.Request.ContentLength > (4 * 1024 * 1024))
        {

        }
    }

The execution path enters this IF block like I want it to. But from here, I'm not really sure where to go. Is this a bad approach?

Edit: As it is (without this module), Fiddler is reporting that IIS is returning a 500 code. I'd like to avoid this and have the code return a 200 from the requested page, just with the warning like I said.

Answer 1

If all you are wanting to do is give the user feedback about the status of large image uploads, then I'd recommend you consider using one of the Ajax or Flash based upload components. There are about a million of them out there and most have very good user feedback. They can also deal with large files and many handle multiple simultaneous file uploads too.

Answer 2

Because of the nature of HTTP, you can't actually return anything until you read all the request data. When you receive an oversized request, you have two options:

• Read in all the data and then return a nice error page. This sounds good, but means the user has to wait for the upload to complete before he gets the message that he can't upload. It also opens a possible DOS attack hole
• Terminate the request immediately. This gives the user a crappy disconnect page, but preserves security.

There is a third option -- use an advanced component that provides both nice error messages as well as security. You can use flash only components, and there are many of them out there, but of course, if the user doesn't have flash, you're out of luck.

Answer 3

Give this a read

Answer 4

The answers above didn't work for me on IIS 7.5. We finally came up with the following:

    void Application_PreSendRequestHeaders(Object sender, EventArgs e)
    {
        if (
            Request.Headers["Content-Length"] != null && 
            int.Parse(Request.Headers["Content-Length"]) > 150000000 &&
            Request.RawUrl.EndsWith("/ProjectReleases.aspx?Mode=Create", StringComparison.OrdinalIgnoreCase))
        {
            try
            {
                Response.Redirect("http://anyurl", true);
            }
            catch (HttpException ex)
            {
                if (String.Compare(ex.Message, "Maximum request length exceeded.", StringComparison.Ordinal) != 0)
                {
                    Server.ClearError();
                    Response.ClearHeaders();
                    Response.Redirect("http://www.edward-williams.com", true);
                }
            }
        }
    }

Didn't have to modify the max upload size. Granted the final version actaully set a static value for the max upload size based on the value in the web.config and redirected to a custom error page vs that homepage, but you get the idea.