Question

Things I already know about upload size limits in MVC:

1. For IIS7 you have to set both maxAllowedContentLength and maxRequestLength for a max upload size
2. I know 1 property is in bytes and the other in kilobytes
3. You can use the location property to specify a fixed location

I have an upload component which should be able to handle up to 200MB files. I dont think its right to set the maxlimit for every single page to 200MB so i want to use the dynamic request URL as location.

The routing pattern for the upload URL is something like this: {dynamicvalue}/ConvertModule/Upload

(“ConvertModule” is the controller and “Upload” is the action.) The hard part is {dynamicvalue}, because of this i cant set a fixed location in web.config.

I don’t want to use flash uploads or something like that as a solution because of session hijacking.

• Question 1 (most important to me): Is there a way to set the upload limit for the giving routing pattern only?
• Question 2: Is it possible to show a custom warning when the upload size was exceeded?

Answer 1

Question 1: Is there a way to set the upload limit for the giving routing pattern only?

Not that I am aware of because the <location> node doesn’t support dynamic urls. But you could cheat it by using the url rewrite module.

So let’s suppose that you have a controller handling file uploads:

public class PicturesController
{
    [HttpPost]
    public ActionResult Upload(HttpPostedFileBase file, int dynamicValue)
    {
        ...
    }
}

and that you have some route configured to match to this controller:

routes.MapRoute(
    "Upload",
    "{dynamicvalue}/ConvertModule/Upload",
    new { controller = "Pictures", action = "Upload" },
    new { dynamicvalue = @"^[0-9]+$" }
);

OK, now let’s setup the following rewrite rule in web.config:

<system.webServer>
    <rewrite>
      <rules>
        <clear />
        <rule name="rewrite the file upload path" enabled="true">
          <match url="^([0-9]+)/ConvertModule/Upload$" />
          <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
          <action type="Rewrite" url="pictures/upload?dynamicvalue={R:1}" />
        </rule>
      </rules>
    </rewrite>
</system.webServer>

So far so good, now you could setup the <location> to pictures/upload:

<location path="pictures/upload">
    <system.web>
        <!-- Limit to 200MB -->
        <httpRuntime maxRequestLength="204800" />
    </system.web>
    <system.webServer>
        <security>
            <requestFiltering>
                <!-- Limit to 200MB -->
                <requestLimits maxAllowedContentLength="209715200" />
            </requestFiltering>
        </security>
    </system.webServer>
</location>

Now you could upload to an url of the following pattern: {dynamicvalue}/ConvertModule/Upload and the url rewrite module will rewrite it to pictures/upload?dynamicvalue={dynamicvalue} but the <location> tag will match pictures/upload and successfully apply the limit:

<form action="/123/ConvertModule/Upload" method="post" enctype="multipart/form-data">
    <input type="file" name="file" />
    <button type="submit">OK</button>
</form>

Question 2: Is it possible to show a custom warning when the upload size was exceeded?

No, you will have to set the limit to a larger value and inside your upload handler check for the file size. And if you can check the file size on the client (HTML5, Flash, Silverlight, …) then do it to avoid wasting bandwidth.