[Mongrel] Limit Request Body Size (Disallow very large File-uploads)

gollomm gollomm at gmail.com
Fri Jun 12 11:50:28 EDT 2009

On Fri, Jun 12, 2009 at 11:07 AM, Stephan Wehner<stephanwehner at gmail.com> wrote:
> On Fri, Jun 12, 2009 at 6:46 AM, gollomm<gollomm at gmail.com> wrote:
>> Hello all,
>> For the last couple of days I was trying to get my
>> Apache/mod_proxy/mongrel setup to limit the size of the request body.
>> The setup is as follows:
>> 1.) Apache acts as a reverse proxy by facilitating mod_rewrite and mod_proxy
>> 2.) Requests for non-static files are passed on to a mongrel_cluster
>> 3.) We use mongrel for our Ruby on Rails application
> ModSecurity?

Well, we are very confined regarding Apache modules. That does not
seem to be an option.

>> Note that due to some restrictions we are unable to use
>> Apache/Passenger for our production deployment.
>> Is there a way to tell mongrel to skip requests which exceed a certain
>> limit (say 20MB) and return a 400 (Bad Request) response or the like?
>> I have tried to use the LimitRequestBody directive of Apache httpd,
>> but this obviously does not work, since Apache httpd passes most of
>> it's requests directly on to mongrel. Thanks for your help!

I am currently looking into how mongrel handlers work and how I would
configure them. No luck so far. Ideally, I would like to change
mongrel's own file upload handler to drop requests which exceed a
certain limit. Here is an interesting thread I came across:

The question is now, where is the code handling file-uploads in the
mongrel source? Alternatively, could somebody provide me some pointers
concerning mongrel handlers? I am a totally new to mongrel...

> -> http://stephan.sugarmotor.org (blog and homepage)
> -> http://www.thrackle.org
> -> http://www.buckmaster.ca
> -> http://www.trafficlife.com
> -> http://stephansmap.org -- http://blog.stephansmap.org
> _______________________________________________
> Mongrel-users mailing list
> Mongrel-users at rubyforge.org
> http://rubyforge.org/mailman/listinfo/mongrel-users

More information about the Mongrel-users mailing list