Close Apache connection with too large file downloads

Question

I am currently working on a site where users can upload files. How to prevent downloading large files? At that time, no option (PHPs post_max_size and upload_max_filesize ) was useful: the file was fully uploaded. I just would like the connection to be closed by too large files (pre-checking the Content-Length HTTP header and checking when the file loads). Is there an Apache directive or PHP configuration key for this?

Thank you for your time!

EDIT: Added Apache conf (CentOS by default).
EDIT2: added PHP conf (CentOS by default).

EDIT3: It seems PHP closes the pipe when specifying a file too large. However, Apache still lets you pass through.

Answer 1

Ok

Thus, the main problem that you are facing is that after the download is completed, the Apache LimitRequestBody or LimitXMLRequestBody directive is applied. It seems that apache is expecting a complete file in a temporary folder before checking the size.

So, you need to disconnect the connection immediately after detecting too large downloads. One of the mod_throttle mods was the module available for this. If you are checking out this alternative to the issue of disabling mod_throttle , you might have a list of bandwidth control modules that can suit your needs.

mod_bwshare , for example, can limit the bandwidth for each IP client, but this is not a limit on every request per IP_. There is also mod_quos that handles a lot of download restrictions, but I can't find many things to control the download (only closing is possible, early slow loading). See also this response to throttle loading .

That way, you can also check the OS level restriction (over the TCP stack) or the advanced firewall (ask about the denial).

You can also use client-side restriction tools, such as hidden form values ​​or js loader options, but, like everything that is used on the client side, from a security point of view, you cannot avoid someone changing the restrictions on the side customer.

Answer 2

You can use apache LimitRequestBody . The syntax is simple (and in bytes):

 LimitRequestBody 10490000 # 10 MB 

This works both in httpd.conf and .htaccess , just be careful if you edit httpd.conf ( sudo service apache2 restart on Ubuntu).

If you need to set limits for each file (avatar upload limit to 5 MB, but limit attachments to 20 MB), you can use <Files> :

 <Files avatarUpload.php> LimitRequestBody 5242880 # 5 MB </Files> <Files attachmentUpload.php> LimitRequestBody 20971520 # 20 MB </Files>