While it’s understood that we can configure IIS on two different levels for basically the same thing using MaxRequestLength and MaxAllowedContentLength (here), it is clear that IIS actually accepts (waits until it’s downloaded) the entire request (potentially hundreds of MBs) before it decides that it must be rejected or filtered out.
Arguably, it is possible to consult header for request size or if header is inaccurate (has the length set to a smaller value than actual request size) – quit as soon as limit is exceeded.
If it matters – I’m working on a HttpHandler.
Is it possible to configure IIS to behave like this?
Well, at least I’ve tried. It appears this is one of the things you just can’t do by design of IIS.