Flask has three request limits: MAX_CONTENT_LENGTH for total body size, MAX_FORM_MEMORY_SIZE for non-file form fields, and MAX_FORM_PARTS for the number of multipart fields. Only the last two have defaults, so set MAX_CONTENT_LENGTH explicitly to the largest request each route should accept.
What each setting does
The Flask security page lists them under resource use, as defenses against denial of service:
| Setting | Default | Effect |
|---|---|---|
| MAX_CONTENT_LENGTH | None | Maximum bytes read for a request, over the limit raises 413 |
| MAX_FORM_MEMORY_SIZE | 500 kB | Largest non-file multipart field |
| MAX_FORM_PARTS | 1000 | Maximum number of multipart fields parsed |
The docs work out the combined effect: with the default field size and part count, a single form could occupy at most 500 MB of memory. That is a lot for one request, especially with several workers. Lower the numbers if your forms are small.
MAX_CONTENT_LENGTH details
The configuration page explains that if the limit is exceeded Flask raises a 413 RequestEntityTooLarge error, and that with a value of None no limit is enforced at the Flask application level. It adds a subtle protection: if it is None and the request has no Content-Length header and the WSGI server does not indicate that it terminates the stream, no data is read, to avoid an infinite stream.
So the unset default is not completely open, but it is not a limit you control. Set it:
app.config["MAX_CONTENT_LENGTH"] = 8 * 1024 * 1024 # 8 MB
app.config["MAX_FORM_MEMORY_SIZE"] = 100 * 1024
app.config["MAX_FORM_PARTS"] = 100
Set limits per route
The same page says each request defaults to the config value, and that you can set Request.max_content_length for a specific view. That lets a profile photo upload accept 8 MB while a login form accepts a few kilobytes:
@app.post("/login")
def login():
request.max_content_length = 4 * 1024
...
Set it before you read the body. Once the data is parsed, the limit has no effect.
Limits at other layers
Flask's page itself says to review what settings are available from your operating system, container deployment, WSGI server, HTTP server and hosting platform, which typically have ways to set process resource limits, timeouts and other checks regardless of how Flask is configured. Do both.
| Layer | What to set |
|---|---|
| Reverse proxy | Maximum body size, header limits, timeouts |
| WSGI server | Worker timeouts, request line and header limits |
| Container | Memory and CPU limits, so one worker cannot take the host |
| Flask | The three settings above, plus per route overrides |
Review checklist
- Search for MAX_CONTENT_LENGTH. If missing, add a value.
- List routes that accept uploads and set their own larger or smaller limits.
- Test with a request body one byte over the limit and confirm a 413.
- Confirm the proxy limit is not lower than your largest legitimate upload, or users will see its error instead of yours.
- Add memory limits to the container.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how an API scan reports missing limits on request handling.
Quick check
Is there a default limit on Flask request size?
MAX_CONTENT_LENGTH is None by default, so Flask enforces no application level limit. Form field size and part count do have defaults.
Where does the 413 come from?
Flask raises RequestEntityTooLarge when a request exceeds the limit. A proxy may return its own 413 earlier.
Safeguard's API security scanning and policy gates can help surface missing limits and keep configuration reviewed. A free scan is available.
Sources
Last reviewed: 19 October 2026.
