Connection reset by server if file upload exceeds size limit about spring-boot HOT 4 CLOSED

Thanks for the report, but this is out of Spring Boot's control as it's up to the underlying web server (Tomcat or Jetty in this case) to apply the max request and file size and to indicate the error to the client.

We recently upgraded our Spring Boot based application from version 3.1.11 to 3.2.7.
We are using the embedded Jetty instead of the embedded Tomcat.

This will have upgraded Jetty from 11 to 12. As such, changes in Jetty's behavior are to be expected as they refine things across major versions.

To be able to send a response to the client and for the client to be able to receive it, the server may need to consume the entirety of the request. Tomcat has a max swallow size property that allows you to control how much of the body it will swallow in order to be able to respond. If the request exceeds that size, it has little choice but to close the connection. Jetty may have something similar that would allow you to tune the behavior, but you should be aware that I don't think it's possible to guarantee that an HTTP error response will be sent to the client.

from spring-boot.

Thank you for the quick response. The reason why we reported the issue here was that it happens on Jetty and on Tomcat. Therefore, we did not suspect the major Jetty upgrade to be the root cause here.

Regarding max swallow size. We also thought about a protection against big file upload attacks. But the issue already appears with files of size 1.4 MB if spring.servlet.multipart.max-file-size is set to 128 KB. Is Tomcat's (or Jetty`s) max swallow size coupled to one of the mentioned Spring Boot properties?

from spring-boot.

You can use server.tomcat.max-swallow-size to configure Tomcat's max swallow size. As I said above, Jetty may have something similar. I don't know for sure though and it's really a question for the Jetty community.

from spring-boot.

We tested with server.tomcat.max-swallow-size and can confirm that this is the explanation in case of Tomcat. We haven't found a similar property for Jetty. I will ask on the jetty project. Thanks for pointing us into the right direction. 👍

from spring-boot.