bitwarden/server · error · InvalidDataException

Multipart boundary length limit {lengthLimit} exceeded.

Error message

Multipart boundary length limit {lengthLimit} exceeded.

What it means

In the same GetBoundary path, the boundary string must not exceed FormOptions.MultipartBoundaryLengthLimit (default 128 characters). An over-long boundary is rejected to prevent abuse and parser strain, throwing InvalidDataException (HTTP 400).

Source

Thrown at src/Api/Utilities/MultipartFormDataHelper.cs:135

                    await callback(dataSection.Body);
                }
            }
            dataSection = null;
        }
    }


    private static string GetBoundary(MediaTypeHeaderValue contentType, int lengthLimit)
    {
        var boundary = HeaderUtilities.RemoveQuotes(contentType.Boundary);
        if (StringSegment.IsNullOrEmpty(boundary))
        {
            throw new InvalidDataException("Missing content-type boundary.");
        }

        if (boundary.Length > lengthLimit)
        {
            throw new InvalidDataException($"Multipart boundary length limit {lengthLimit} exceeded.");
        }

        return boundary.ToString();
    }

    private static bool HasFileContentDisposition(ContentDispositionHeaderValue content)
    {
        // Content-Disposition: form-data; name="data"; filename="Misc 002.jpg"
        return content != null && content.DispositionType.Equals("form-data") &&
            (!StringSegment.IsNullOrEmpty(content.FileName) || !StringSegment.IsNullOrEmpty(content.FileNameStar));
    }

    private static bool HasDispositionName(ContentDispositionHeaderValue content, string name)
    {
        // Content-Disposition: form-data; name="key";
        return content != null && content.DispositionType.Equals("form-data") && content.Name == name;
    }
}

View on GitHub (pinned to e93b962371)

Solutions

1. Use a short boundary (<= 70 characters is typical and safe).
2. Let the HTTP library generate the boundary instead of supplying one.
3. If a longer boundary is genuinely required, raise FormOptions.MultipartBoundaryLengthLimit in server configuration.

Example fix

// before
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAAAA...200chars
// after
Content-Type: multipart/form-data; boundary=----boundary123

const BOUNDARY_LIMIT = 128; // server default
function makeBoundary() {
  const b = '----bw' + Math.random().toString(36).slice(2, 10);
  if (b.length > BOUNDARY_LIMIT) throw new Error('Generated boundary too long');
  return b;
}

function isBoundaryShortEnough(boundary: string, limit = 128): boolean {
  return typeof boundary === 'string' && boundary.length <= limit;
}

When it happens

Trigger: A client sends a multipart boundary token longer than the configured limit (default 128 chars).

Common situations: A custom boundary generator producing very long random strings; a gateway rewriting the boundary; the default limit having been lowered in server config.

Related errors

• Missing content-type boundary.
• Invalid content.
• You cannot remove yourself.
• Organization already belongs to a provider.
• The organization is subscribed to Secrets Manager. Please co

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/bc324be7ff1df81f. Report an issue: GitHub.