nginx ships with sensible limits: 60 seconds to send headers, a 1 MB body cap, and 8 KB header buffers. They work as abuse limits, but only if you know them and change them on purpose. A blanket client_max_body_size 0 for convenience removes the main one.
The defaults
From the nginx core module documentation:
| Directive | Default | What happens when exceeded |
|---|---|---|
| client_header_timeout | 60s | 408 Request Time-out |
| client_body_timeout | 60s | 408, measured between two reads |
| client_max_body_size | 1m | 413 Request Entity Too Large |
| large_client_header_buffers | 4 8k | 414 for a long request line, 400 for a long header field |
Note the body timeout applies only between two successive reads, not to the whole body. A client sending a byte every 50 seconds is never cut off by that rule alone.
Slow clients
Slow request attacks hold connections open with small trickles of data. The header timeout bounds the header phase. The body timeout bounds silence during the body. Lowering both to something like 10 to 15 seconds is reasonable for a typical web app, but test uploads from slow mobile networks before shipping it.
Add limit_conn for concurrency. It counts a connection only once the full request header has been read, which means it does not cover the header phase itself, so the header timeout still matters. See limit_conn versus limit_req.
Body size
The 1 MB default is small on purpose. Raise it per location for the places that need uploads, not globally.
http {
client_max_body_size 1m;
}
server {
location /upload {
client_max_body_size 50m;
}
}
Setting it to 0 disables the check. The docs also note that browsers cannot correctly display the 413 error, so your application should check size on the client side too for a clean message.
Apache has the same idea: LimitRequestBody defaults to 1 GB in recent versions, and was unlimited in 2.4.53 and earlier. That default is far looser than nginx, so set your own.
Header limits
A request line longer than one buffer returns 414. A header field longer than one buffer returns 400. Large cookies or tokens can trip this, so raise buffers only if a real client needs it. Buffers are allocated on demand.
Backend side timeouts
proxy_read_timeout defaults to 60s and applies between two reads, not the whole response. proxy_connect_timeout is 60s by default. Long timeouts keep a worker connection busy for a slow backend. If a slow endpoint is expected, raise the timeout on that location only.
Checklist
- Write down the largest legitimate upload per endpoint.
- Set client_max_body_size at http level to a small value and override per location.
- Lower header and body timeouts after testing on slow links.
- Keep large_client_header_buffers at default unless a real client fails.
- Log 408, 413 and 414 responses and look at them weekly.
Where Safeguard fits
Safeguard covers the dependencies and containers behind your proxy, not these limits. A free scan is available at https://gold.safeguard.sh/scan.
Quick check
What status does nginx return when a body exceeds client_max_body_size?
413 Request Entity Too Large. The default limit is 1 MB.
Does client_body_timeout limit total upload time?
No. It only applies between two successive reads.
Sources
Last reviewed: 19 October 2026.
