Catch upload of to big files - asp.net

Question

Asp.Net has an upper limit for file uploads. I try to catch this situation on the server side. According to the documentation I found, it should be possible to override Application_Error in Global.asax, but it does not work for me. The second option would be to override OnError of the receiving page, but that also does not work.
Can anybody show some working code on how to catch this error on the server side?

Answer 1

Put following in Golobal.asax.cs:
void Application_Error(Object sender, EventArgs e)
{
HttpException ex = Server.GetLastError() as HttpException;
if (ex != null)
{
if ((ex.GetHttpCode() == 500 || ex.GetHttpCode() == 400) && ex.ErrorCode == -2147467259)
{
Server.ClearError();
Response.Redirect("~/MaximumFileError.aspx", false);
}
}
}
This worked for me, but I'm not sure if it works for all cases.

Answer 2

Uploadify is a jquery and flash uploader that allows you to specify a max size for files to be downloaded. This way you can prevent the user from downloading the file in the first place and dont have to worry about catching it after.

Answer 3

Rather than catch the error can't you check the size of the file against the maximum size specified in the web.config file? You can use the following to get the max size:
System.Configuration.Configuration config = WebConfigurationManager.OpenWebConfiguration("~");
HttpRuntimeSection section = config.GetSection("system.web/httpRuntime") as HttpRuntimeSection;
double maxFileSize = section.MaxRequestLength;

Answer 4

"Can anybody show some working code on
how to catch this error on the server
side?"
Nope. It's not possible to use code to catch this error, as it occurs before any code is started.
As far as I have found, you can't even specify an alternative error page for this error, the web server just refuses to accept the request when it's too large.

Answer 5

First you should understand few things about maxRequestLength. Using a server side approach validation you cannot predict what will be file size. Setting value to high is increasing the risk of DoS Attack.
I set in web.config maxRequestLength to 8MB:
<httpRuntime maxRequestLength="8192" executionTimeout="3600" />
I check in my code-behind of form if uploaded by user file is not greater than half of given in maxRequestLength, but this checking may never happen if the size of uploaded file turn out to be greater than max RequestLength specified in web.config, because the exception will be thrown. Such exception should be catch on the level of Global.asax. There I check whether the Exception is containing words identifying our problem, because System.Web.HttpUnhandledException can be thrown in many other situations! Good hint may be checking from which page the exception come, to be sure that we deal with certain form, what is important by redirecting user back to form.
void Application_Error(object sender, EventArgs e){
Exception wyjatek = Server.GetLastError();
if (wyjatek.InnerException != null && wyjatek.InnerException.Message.Contains("Maximum request length exceeded"))
{
Server.ClearError();
Response.Redirect("FormWithFile.aspx?alert=Za-duzy-plik");
}
}
If I recognize in Global.asax this exception I redirect user to the page with alert(given in GET).
In my code-behind of ASPX page:
First I retrive value of MaxRequestLength from web.config by this tree lines, and half it:
static System.Configuration.Configuration config = WebConfigurationManager.OpenWebConfiguration("~");
static HttpRuntimeSection section = config.GetSection("system.web/httpRuntime") as HttpRuntimeSection;
int maxFileSize = (section.MaxRequestLength/2)*1024;
Then in Action connected with insert button, I proceed as follows:
protected void InsertButton_Click(object sender, EventArgs e)
{
if (((FileUpload)FormView1.FindControl("FileUpload1")).HasFile) // WHEN USER WANT TO UPLOAD FORM WITH FILE (its, optional)
{
HttpPostedFile file = (HttpPostedFile)(((FileUpload)FormView1.FindControl("FileUpload1")).PostedFile);
int iFileSize = file.ContentLength;
if ((file != null) && (file.ContentLength > 0))
{
if (iFileSize > maxFileSize) // checking image SIZE!
{
MessageForUser.Text = "<h1 class=error>Bad File! File is to big!</h1>";
}
else
{
byte[] plik = ((FileUpload)FormView1.FindControl("FileUpload1")).FileBytes;
// HERE COMES CODE FOR INSERT OF FORM WITH FILE
MessageForUser.Text = "<h1>Insert was sucessfull</h2>";
}
}
}
else
{
// HERE COMES CODE FOR INSERT OF FORM WITHOUT FILE
MessageForUser.Text = "<h1>Insert was sucessfull</h2>";
}
}
In Page_Load I define also how to retrive communicate given by GET from Global.asax, to inform the user what happend.
if (Request.QueryString["alert"]!=null)
{
string temp = Request.QueryString["alert"].Replace('-',' ');
MessageForUser.Visible = true;
MessageForUser.Text = "<h1 class=error>ERROR: " + temp + "</h1>";
}
This solution has of course its drawbacks:
Still, we can be under DoS attack with 8MB files, what we recognize first at level of server, what is already very late.
The state of user form is lost in case of redirection from Global.asax, but this with some bit of code can be overcome.
User expirience is rather poor, because of checks on the server side, and by the load of many users, applicaiton can become slow.
Temporarly to the server come files even greater than 8MB, but such which manage in executionTimeout
Possible alternatives:
Use some flash technology to check on client side the file size
Use some stream techniques, to transfer bites in small packets, and in the moment, when given threshold is reached, throw own exception and handle it.
apropriate reading: Sending File in Chunks to HttpHandler