If I send a payload of, for example, 10MB to an apache server, the limit being 2MB. How does the server know that the payload is 10MB? Doesn't he need to receive the file anyway, and check its size? Doesn't this theoretically make the server vulnerable to DDoS? Since I can send huge data, forcing the server to measure its size?


The server knows the size of the payload by looking at the POST request which contains the size of the request - Content-Length header or when the content is chunked data is sent in a series of chunks. The Content-Length header is omitted in this case and at the beginning of each chunk you need to add the length of the current chunk in hexadecimal format, followed by '\r\n' and then the chunk itself, followed by another '\r\n' [1]

post_max_size is a php directive. The apache server directive is LimitRequestBody [2][3]

Your question is not providing enough information about how you run the PHP under Apache.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.