9

I am using tornado to make an image processing RESTful service, which is accepting images uploaded by general HTTP means like multipart/form-data. I then access them in handlers using self.request.files.

It could be that an adversary will try to upload a huge file to break down a service. Is there any way to tell tornado an uploaded file size limit, exceeding which file should be discarded and error HTTP status should be set?

3 Answers 3

11

I've tried this, It works! max_buffer_size default value is 100 M.

import tornado.httpserver

app = tornado.web.Application([
    (r'/upload/', UploadFileHandler),
])

server = tornado.httpserver.HTTPServer(app, max_buffer_size=10485760000)  # 10G
server.listen(8888)
tornado.ioloop.IOLoop.instance().start()
4

You can pass a max_buffer_size parameter when creating the server. For example to allow for 160MB uploads"

HTTPServer(app, max_buffer_size=167772160)
2

You have to configure this on the web server. For example, using nginx:

client_max_body_size 50M;

Edit: The stream that HttpServer uses has a max_buffer_size property. HttpServer will not accept uploads bigger than this. The default value for it is 100MB. It seems to me that HttpServer simply closes the connection instead of sending a HTTP response when this limit is reached.

2
  • 1
    So the question is how to configure this option for tornado.
    – bazzilic
    Oct 5, 2012 at 12:49
  • 2
    Sorry, I have edited my question to contain slightly more useful information.
    – Sjoerd
    Oct 5, 2012 at 13:20

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.