dotnet / dotnet/aspnetcore

Form key length limit 2048 exceeded

Open
#18,871 11 comments 0 reactions 0 assignees View on GitHub
affected-very-few area-networking bug investigate severity-nice-to-have
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

I have a similar issue to #11262 , where I'm randomly getting "Form key length limit 2048 exceeded" after upgrading to asp.net core 3.1 from asp.net core 2.2

Situation is I'm passing a large Base64Url encoded to client and getting it back in a POST call. Then I'll read the posted field using Request.Form["fieldname"]

I'm getting "Form key length limit 2048 exceeded". At first I've started to add the attribute ` [RequestFormLimits(KeyLengthLimit = 30_000, ValueCountLimit = 1500, ValueLengthLimit = 100_000)]` to be able to get to the actual problem, which is that form parser seems to be getting parts of the value of that field as the Form Key.

To explain better let's have an example:

Form contains:
Arg1: Value1 (small string),
Arg2: Value2 (very large base64url string like eyJUYXJnZXRCYXNlTmFtZSI6IjkzM2U0Yzc2...)
Arg3: Value3,
Arg4: Value4
...
ArgN: ValueN

When it reaches the Request.Form["Arg2"] it's empty!

Now I've tried to dump the whole Request.Form

```csharp
foreach (var formFieldName in httpContext.Request.Form.Keys.Take(100))
```

And I see in my logs that form looks like
Arg1 key: Value1
Arg2 parts of Value2 like nZXRCYX [not the Arg2 key, but part of value become the key]: empty value
Arg3 key: some times Value3, some times rest of Arg2 Value
Arg4 key: some time Value4, some times rest of Arg2 Value
...
ArgN: ValueN

that was why I was getting that exception "Form key length limit 2048 exceeded" since parts of value was part of being parsed as the key! which make sense.

Now also I've added some code to be able to dump the whole Request.Body and it's okay. Also I've tried to call again using that same Body and nothing happens. Everyday we have 3-4 requests failing like this. So somehow this new FormPipeReader is flaky with Request.Form.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.