chore(conf): client_max_body_size to 10m by default

changelog/unreleased/kong/change-default-value-of-client-max-body-size.yml

@@ -0,0 +1,5 @@
+message: |
+    **Important** Changed the default value of `nginx_http_client_max_body_size` in
+    Kong configuration from `0` (unbounded) to `10m` (10 megabytes).
+type: bugfix
+scope: Configuration

kong.conf.default

@@ -1135,15 +1135,15 @@
                                                 # requests headers.
                                                 # See http://nginx.org/en/docs/http/ngx_http_core_module.html#large_client_header_buffers
 
-#nginx_http_client_max_body_size = 0  # Defines the maximum request body size
-                                      # allowed by requests proxied by Kong,
-                                      # specified in the Content-Length request
-                                      # header. If a request exceeds this
-                                      # limit, Kong will respond with a 413
-                                      # (Request Entity Too Large). Setting
-                                      # this value to 0 disables checking the
-                                      # request body size.
-                                      # See http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
+#nginx_http_client_max_body_size = 10m  # Defines the maximum request body size
+                                        # allowed by requests proxied by Kong,
+                                        # specified in the Content-Length request
+                                        # header. If a request exceeds this
+                                        # limit, Kong will respond with a 413
+                                        # (Request Entity Too Large). Setting
+                                        # this value to 0 disables checking the
+                                        # request body size.
+                                        # See http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
 
 #nginx_admin_client_max_body_size = 10m  # Defines the maximum request body size for
                                          # Admin API.

kong/templates/kong_defaults.lua

@@ -84,7 +84,7 @@ nginx_main_worker_rlimit_nofile = auto
 nginx_events_worker_connections = auto
 nginx_events_multi_accept = on
 nginx_http_charset = UTF-8
-nginx_http_client_max_body_size = 0
+nginx_http_client_max_body_size = 10m
 nginx_http_client_body_buffer_size = 8k
 nginx_http_ssl_protocols = NONE
 nginx_http_ssl_prefer_server_ciphers = NONE

spec/01-unit/04-prefix_handler_spec.lua

@@ -775,17 +775,30 @@ describe("NGINX conf compiler", function()
         assert.not_matches("keepalive%s+%d+;", nginx_conf)
       end)
 
-      describe("default injected NGINX directives", function()
+      describe("default injected NGINX directives (proxy)", function()
         it("configures default body buffering directives", function()
-          local conf = assert(conf_loader())
+          local conf = assert(conf_loader(nil, {
+            admin_listen = "off",
+            stream_listen = "off",
+          }))
           local nginx_conf = prefix_handler.compile_kong_conf(conf)
-          assert.matches("client_max_body_size%s+0;", nginx_conf)
-          assert.matches("client_body_buffer_size%s+8k;", nginx_conf)
-          -- Admin API Defaults:
           assert.matches("client_max_body_size%s+10m;", nginx_conf)
-          assert.matches("client_body_buffer_size%s+10m;", nginx_conf)
+          assert.matches("client_body_buffer_size%s+8k;", nginx_conf)
          end)
       end)
+
+      describe("default injected NGINX directives (admin)", function()
+        it("configures default body buffering directives", function()
+          local conf = assert(conf_loader(nil, {
+            proxy_listen = "off",
+            stream_listen = "off",
+          }))
+          local nginx_conf = prefix_handler.compile_kong_conf(conf)
+          assert.matches("client_max_body_size%s+10m;", nginx_conf)
+          assert.matches("client_body_buffer_size%s+8k;", nginx_conf)
+        end)
+      end)
+
     end)
   end)
 

spec/02-integration/05-proxy/07-upstream_timeouts_spec.lua

@@ -111,6 +111,7 @@ for _, strategy in helpers.each_strategy() do
       assert(helpers.start_kong({
         plugins    = "bundled, ctx-checker-last",
         database   = strategy,
+        nginx_http_client_max_body_size = 0,
         nginx_conf = "spec/fixtures/custom_nginx.template",
       }))
     end)