Repository navigation
Answer 413 for multipart and server body limits under Draft20260903 - #10452
Merged
Merged
Conversation
github-actions
Bot
added
📚 documentation
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The new multipart reader changes antiforgery rejection behavior despite the stated compatibility guarantee.
Review effort: Balanced
Findings: 1
What changed in this PR
Adds size-specific GraphQL errors and Draft20260903 HTTP 413 responses for multipart and server-enforced body limits.
Changes:
- Introduces
HC0135/HC0136and a limit-aware multipart reader. - Expands transport coverage across POST, QUERY, multipart, buffering, and antiforgery scenarios.
- Updates migration documentation and documentation CI.
| File | Description |
|---|---|
website/content/docs/hotchocolate/server/http-transport.md |
Documents 413 size refusals. |
website/content/docs/hotchocolate/server/files.md |
Documents multipart limits and error codes. |
website/content/docs/hotchocolate/server/endpoints.md |
Extends request-size documentation to multipart operations. |
website/content/docs/hotchocolate/migrating/migrate-from-16-6-to-16-7.md |
Adds server migration guidance. |
website/content/docs/fusion/request-limits.md |
Documents Fusion multipart limits. |
website/content/docs/fusion/migration/migrate-from-16-6-to-16-7.md |
Adds Fusion migration guidance. |
src/HotChocolate/Primitives/src/Primitives/ErrorCodes.cs |
Defines the new error codes. |
src/HotChocolate/Fusion/src/Fusion.AspNetCore/DependencyInjection/FusionServerServiceCollectionExtensions.cs |
Registers Fusion request limits. |
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/Parsers/MultipartFormReaderTests.cs |
Tests multipart parsing and limits. |
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/Parsers/LengthLimitedReadStreamTests.cs |
Tests stream boundaries. |
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/HttpMultipartMiddlewareTests.cs |
Tests antiforgery handling. |
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/GraphQLOverHttpSpecTests.cs |
Tests version-specific statuses and errors. |
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/__snapshots__/HttpMultipartMiddlewareTests.Upload_Too_Large_File_Test.snap |
Updates oversized-file output. |
src/HotChocolate/AspNetCore/src/AspNetCore/Extensions/HotChocolateAspNetCoreServiceCollectionExtensions.cs |
Registers server request limits. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Utilities/ThrowHelper.cs |
Centralizes new exceptions. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Utilities/MiddlewareHelper.cs |
Marks all size errors as oversized requests. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Utilities/HttpResultContextData.cs |
Generalizes request-size metadata. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Properties/AspNetCorePipelineResources.resx |
Adds error messages. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Properties/AspNetCorePipelineResources.Designer.cs |
Adds generated resource accessors. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Parsers/MultipartFormReader.cs |
Implements limit-aware multipart parsing. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Parsers/LengthLimitedReadStream.cs |
Implements bounded reads. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Parsers/HttpRequestLimits.cs |
Holds normalized HTTP limits. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Parsers/DefaultHttpRequestParser.cs |
Converts server 413 failures. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/HttpMultipartMiddleware.cs |
Uses the new multipart reader. |
src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/ExecutorSession.cs |
Exposes the configured request limit. |
docs/updating-dotnet.md |
Documents upstream synchronization checks. |
dictionary.txt |
Adds documentation vocabulary. |
AGENTS.md |
Links the .NET update procedure. |
.github/workflows/ci.yml |
Lints and spellchecks docs/. |
Files not reviewed (1)
- src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Properties/AspNetCorePipelineResources.Designer.cs: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Patch coverage94.6% of changed lines covered (209/221)
Uncovered changed lines (JSON){
"sha": "40807fc63f5f039409b4c1e619a7f74b751615da",
"files": [
{ "path": "src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Parsers/LengthLimitedReadStream.cs", "ranges": [[20, 20], [22, 22], [26, 27], [31, 32], [62, 62], [64, 64], [67, 67]] },
{ "path": "src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Utilities/ThrowHelper.cs", "ranges": [[159, 159]] },
{ "path": "src/HotChocolate/AspNetCore/src/AspNetCore.Pipeline/Parsers/MultipartFormReader.cs", "ranges": [[163, 164]] }
]
}Project coverage: 57.8% (299366/518134 lines) |
This was referenced Oct 25, 2026
Merged
This was referenced Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Draft20260903transport version. UnderDraft20250508it answers 400, and underLegacyanapplication/jsonresponse stays 200.HC0010stays themaxAllowedRequestSizecode and now also covers a multipartoperationsfield. The newHC0135covers a multipart section overFormOptions.MultipartBodyLengthLimit, and the newHC0136a body over the web server's limit or overFormOptions.BufferBodyLengthLimit.FormFeature's multipart branch (identical from .NET 8 to .NET 11), so each limit throws its own error while the structure refusals and their messages stay as they were. The reader refuses any request whoseIAntiforgeryValidationFeaturereportsIsValidasfalse.FormFeaturealso requires an internal marker, but the antiforgery and CSRF protection middlewares set that marker whenever they record a verdict, so with them the answer is unchanged.docs/updating-dotnet.mdlists what to recheck when the target frameworks or the SDK change, AGENTS.md points to it, and CI now spellchecks and lintsdocs/.operationsfield overmaxAllowedRequestSizeis refused (MultipartBodyLengthLimitstill applies to it, and the smaller of the two decides the code); an oversized section carriesHC0135in place ofHC0033; the web server's limit carriesHC0136in place ofHC0012orHC0033; and a body overBufferBodyLengthLimitcarriesHC0136in place ofHC0033.Test plan
GraphQLOverHttpSpecTestspins each limit underDraft20250508andDraft20260903, and underLegacyforoperations: the web server's limit for POST, QUERY, and multipart, theoperationsfield, a file andmapover the section limit, andBufferBodyLengthLimit. A form over the section-count limit still gets a 400 status code under both versions.MultipartFormReaderTestschecks parity withFormFeaturefor the structure refusals and their messages, each limit at and past its boundary, both orderings of the twooperationslimits, the header limits, buffered and seekable bodies, and the antiforgery check. Removing any limit fails exactly its test.HotChocolate.AspNetCore.Testspasses on net8.0 to net11.0, as doHotChocolate.Fusion.AspNetCore.Testson net10.0 and both Azure Functions test projects.