{"record":{"id":"46dec4f4ae41b602","repo":"withastro/astro","slug":"request-body-exceeds-the-configured-limit-of-lim","errorCode":null,"errorMessage":"Request body exceeds the configured limit of ${limit} bytes","messagePattern":"Request body exceeds the configured limit of (.+?) bytes","errorType":"http","errorClass":"BodySizeLimitError","httpStatus":413,"severity":"error","filePath":"packages/astro/src/core/request-body.ts","lineNumber":19,"sourceCode":"/**\n * Shared utility for reading request bodies with a size limit.\n * Used by both Actions and Server Islands to enforce `security.actionBodySizeLimit`\n * and `security.serverIslandBodySizeLimit` respectively.\n */\n\n/**\n * Read the request body as a `Uint8Array`, enforcing a maximum size limit.\n * Checks the `Content-Length` header for early rejection, then streams the body\n * and tracks bytes received.\n *\n * @throws {BodySizeLimitError} if the body exceeds the configured limit\n */\nexport async function readBodyWithLimit(request: Request, limit: number): Promise<Uint8Array> {\n\tconst contentLengthHeader = request.headers.get('content-length');\n\tif (contentLengthHeader) {\n\t\tconst contentLength = Number.parseInt(contentLengthHeader, 10);\n\t\tif (Number.isFinite(contentLength) && contentLength > limit) {\n\t\t\tthrow new BodySizeLimitError(limit);\n\t\t}\n\t}\n\n\tif (!request.body) return new Uint8Array();\n\tconst reader = request.body.getReader();\n\tconst chunks: Uint8Array[] = [];\n\tlet received = 0;\n\twhile (true) {\n\t\tconst { done, value } = await reader.read();\n\t\tif (done) break;\n\t\tif (value) {\n\t\t\treceived += value.byteLength;\n\t\t\tif (received > limit) {\n\t\t\t\tthrow new BodySizeLimitError(limit);\n\t\t\t}\n\t\t\tchunks.push(value);\n\t\t}\n\t}","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/withastro/astro/blob/d081033d5fe8e8a68c4bbbad4af9d2deb9c74bca/packages/astro/src/core/request-body.ts#L1-L37","documentation":"readBodyWithLimit() rejected the request early because the Content-Length header exceeds the configured byte limit. This is the fast-path check used by Actions (security.actionBodySizeLimit) and Server Islands (security.serverIslandBodySizeLimit) to deny oversized payloads before streaming.","triggerScenarios":"A POST/fetch to an Action or Server Island whose Content-Length is greater than the configured limit; large JSON/form payloads; misconfigured low limit; client sending unexpectedly big bodies.","commonSituations":"Default body size limits too low for legitimate payloads (e.g. large form, base64 image); actions receiving big JSON; server islands receiving large props; testing with oversized fixtures.","solutions":["Raise the relevant limit in astro.config: security.actionBodySizeLimit or security.serverIslandBodySizeLimit.","Reduce the payload size on the client (compress, chunk uploads, offload large data to a separate endpoint).","If the value is unexpected, inspect what the client is sending — a runaway payload may indicate a bug.","Ensure the limit unit matches bytes (not kilobytes)."],"exampleFix":"// before — astro.config.mjs\nexport default defineConfig({\n  security: { actionBodySizeLimit: 100 } // 100 bytes, too small\n});\n\n// after\nexport default defineConfig({\n  security: { actionBodySizeLimit: 1_000_000 } // ~1 MB\n});","handlingStrategy":"validation","validationCode":"function withinContentLength(request: Request, limit: number): boolean {\n  const cl = Number.parseInt(request.headers.get('content-length') ?? '', 10);\n  return Number.isFinite(cl) ? cl <= limit : true;\n}\n// client-side: check before sending\nif (!withinContentLength(request, LIMIT)) return errorResponse();","typeGuard":null,"tryCatchPattern":"try {\n  await readBodyWithLimit(request, limit);\n} catch (e) {\n  if (e instanceof BodySizeLimitError) return new Response('Payload too large', { status: 413 });\n  throw e;\n}","preventionTips":["Right-size security.actionBodySizeLimit / security.serverIslandBodySizeLimit for real payloads.","Compress or chunk large uploads on the client.","Return HTTP 413 gracefully when the limit is exceeded."],"tags":["security","request-body","limits","actions","server-islands"],"backgroundTag":null,"analyzedSha":"d081033d5fe8e8a68c4bbbad4af9d2deb9c74bca","analyzedAt":"2026-08-12T13:37:29.035Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}