nginx lets through the uploads the backend accepts: no limit was set, so its 1 MB default refused them all (#1057) #1058

Merged

claude-bot merged 2 commits from fix/1057-nginx-upload-limit into main 2026-10-04 00:58:24 +00:00

Conversation 0 Commits 2 Files changed 3 +60

claude-bot commented 2026-10-04 00:03:02 +00:00

Collaborator

Copy link

Closes #1057.

Summary

nginx.conf set no client_max_body_size, so nginx's default of 1 MB applied to everything proxied to the backend. Confirmed on dev (v4.5.0-rc2): a 2 MB POST to /api/campaigns/import gets nginx's 413 and never reaches the app, while a 0.5 MB one does. That refused every map image (the backend allows 75 MB), handout file and page picture (8 MB), and campaign import (100 MB) in a deployed build. The v4.4.1 tag's nginx.conf has none either, so production behaves the same.

• The fix. location /api/ sets client_max_body_size 110m, just above the largest upload the backend accepts. The backend keeps the per-kind limits and their worded messages.
• The guard. A new test, tests/test_nginx_upload_limit.py, reads nginx.conf and fails if the proxy's limit is missing or falls below the backend's largest (media_max_upload_bytes, map_max_upload_bytes, and the import's cap). Nothing caught this before: the backend suite calls the app directly, and the journeys upload small files.

#991 part 2 will give the import route its own location, with the backend's admin-settable limit as the only one.

Changelog

• changelog.d/1057-nginx-upload-limit.fixed.md

Test plan

• The new test: 2 passed (on docker-test, in the backend image).
• nginx -t on the edited config in nginx:1.31-alpine: syntax ok, test successful.
• ruff 0.4.4 format and check on the new file: clean.
• CI on this PR.
• Not yet seen in a running build: a real upload over 1 MB going through. That needs the image this PR builds; it is the first thing to check on dev after the next prerelease.

🤖 Generated with Claude Code

Closes #1057. ## Summary `nginx.conf` set no `client_max_body_size`, so nginx's default of 1 MB applied to everything proxied to the backend. Confirmed on dev (`v4.5.0-rc2`): a 2 MB POST to `/api/campaigns/import` gets nginx's 413 and never reaches the app, while a 0.5 MB one does. That refused every map image (the backend allows 75 MB), handout file and page picture (8 MB), and campaign import (100 MB) in a deployed build. The `v4.4.1` tag's `nginx.conf` has none either, so production behaves the same. - **The fix.** `location /api/` sets `client_max_body_size 110m`, just above the largest upload the backend accepts. The backend keeps the per-kind limits and their worded messages. - **The guard.** A new test, `tests/test_nginx_upload_limit.py`, reads `nginx.conf` and fails if the proxy's limit is missing or falls below the backend's largest (`media_max_upload_bytes`, `map_max_upload_bytes`, and the import's cap). Nothing caught this before: the backend suite calls the app directly, and the journeys upload small files. #991 part 2 will give the import route its own location, with the backend's admin-settable limit as the only one. ## Changelog - [x] `changelog.d/1057-nginx-upload-limit.fixed.md` ## Test plan - [x] The new test: 2 passed (on docker-test, in the backend image). - [x] `nginx -t` on the edited config in `nginx:1.31-alpine`: syntax ok, test successful. - [x] ruff 0.4.4 format and check on the new file: clean. - [ ] CI on this PR. - [ ] Not yet seen in a running build: a real upload over 1 MB going through. That needs the image this PR builds; it is the first thing to check on dev after the next prerelease. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 2 commits 2026-10-04 00:03:04 +00:00

nginx lets through the uploads the backend accepts: no limit was set, so its 1 MB default refused them all (#1057) ... b7d7ea10b2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ruff format the nginx limit test (#1057) ... a0837dc04c

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot merged commit c5450e3aff into main 2026-10-04 00:58:24 +00:00

claude-bot referenced this pull request from a commit 2026-10-04 00:58:25 +00:00

Merge PR #1058: nginx lets through the uploads the backend accepts (#1057)

claude-bot deleted branch fix/1057-nginx-upload-limit 2026-10-04 00:58:26 +00:00

claude-bot referenced this pull request 2026-10-04 00:58:33 +00:00

nginx refuses every upload over 1 MB: maps, handout files, larger pictures and campaign imports fail in a deployed build #1057

claude-bot referenced this pull request 2026-10-04 03:38:26 +00:00

A damaged image is refused in words, not with a 500 (#1065) #1066

rbrooks referenced this pull request from a commit 2026-10-04 06:57:14 +00:00

chore(release): v4.5.0-rc3

claude-bot referenced this pull request 2026-10-04 06:57:21 +00:00

chore(release): v4.5.0-rc3 #1073

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

backend

Issue related to the backend

  

bot

Issue related to the bot

  

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

frontend

Issue related to the frontend

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

recording

Issue related to the recording system

  

security

Security hardening / vulnerability work

  

wontfix

This won't be fixed

No labels

backend

bot

bug

duplicate

enhancement

frontend

help wanted

invalid

question

recording

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/Quest-Board!1058

No description provided.