Question

I searched SO and found this question, but it’s not quite what I’m asking. I’m wondering if a IHttpModule can be created that can inspect the ContentLength of the request, and if so either redirect or somehow throw that request out and create a new one.

Specifically, I’m trying to handle image file uploads, but I’d like to have the request continue on to the upload page with some kind of warning, rather than a flat error page. I have this bit of code that gets hit with a large request:

    private void context_BeginRequest(object sender, EventArgs e)     {         HttpApplication application = (HttpApplication)sender;         HttpContext context = application.Context;          if (context.Request.ContentLength > (4 * 1024 * 1024))         {          }     } 

The execution path enters this IF block like I want it to. But from here, I’m not really sure where to go. Is this a bad approach?

Edit: As it is (without this module), Fiddler is reporting that IIS is returning a 500 code. I’d like to avoid this and have the code return a 200 from the requested page, just with the warning like I said.

Answer 1

Because of the nature of HTTP, you can’t actually return anything until you read all the request data. When you receive an oversized request, you have two options:

• Read in all the data and then return a nice error page. This sounds good, but means the user has to wait for the upload to complete before he gets the message that he can’t upload. It also opens a possible DOS attack hole
• Terminate the request immediately. This gives the user a crappy disconnect page, but preserves security.

There is a third option — use an advanced component that provides both nice error messages as well as security. You can use flash only components, and there are many of them out there, but of course, if the user doesn’t have flash, you’re out of luck.