Introduction

Increasing upload size in ASP.NET is not a single setting. The effective limit usually depends on the application framework, the hosting server, and sometimes request buffering behavior in the upload code itself. The correct fix is to change the size limits in the layer that is actually rejecting the request.

First Identify Which ASP.NET Stack You Are Using

There are two common cases:

• ASP.NET Framework running under IIS with web.config
• ASP.NET Core using Kestrel, IIS, or both

The configuration style is different between them, so copying random examples often leads to changing the wrong setting.

ASP.NET Framework Under IIS

In classic ASP.NET Framework applications, the two most common limits are:

• 'httpRuntime maxRequestLength in kilobytes'
• IIS requestLimits maxAllowedContentLength in bytes

A typical web.config setup for roughly 500 MB looks like this:

1<configuration>
2  <system.web>
3    <httpRuntime maxRequestLength="512000" executionTimeout="3600" />
4  </system.web>
5
6  <system.webServer>
7    <security>
8      <requestFiltering>
9        <requestLimits maxAllowedContentLength="524288000" />
10      </requestFiltering>
11    </security>
12  </system.webServer>
13</configuration>

If one of these is smaller than the other, the smaller one wins. That is why changing only httpRuntime sometimes appears to do nothing.

ASP.NET Core with Kestrel

ASP.NET Core uses different APIs. If the app is hosted with Kestrel, request size can be configured in code.

1using Microsoft.AspNetCore.Server.Kestrel.Core;
2
3var builder = WebApplication.CreateBuilder(args);
4
5builder.WebHost.ConfigureKestrel(options =>
6{
7    options.Limits.MaxRequestBodySize = 524_288_000; // 500 MB
8});
9
10var app = builder.Build();
11app.MapGet("/", () => "ok");
12app.Run();

If you only set Kestrel but your app is behind IIS or another proxy that enforces a smaller limit first, the upload still fails upstream.

ASP.NET Core Multipart Form Limits

File uploads often arrive as multipart form data, which may have their own limit settings. In ASP.NET Core, you can adjust form options like this:

1using Microsoft.AspNetCore.Http.Features;
2
3var builder = WebApplication.CreateBuilder(args);
4
5builder.Services.Configure<FormOptions>(options =>
6{
7    options.MultipartBodyLengthLimit = 524_288_000; // 500 MB
8});
9
10var app = builder.Build();
11app.MapPost("/upload", async (IFormFile file) =>
12{
13    return Results.Ok(new { file.FileName, file.Length });
14});
15app.Run();

This matters because large uploads can fail at the form parsing stage even if the server's raw request limit was increased.

IIS and Reverse Proxy Considerations

If ASP.NET Core is hosted behind IIS, IIS can reject the request before it reaches your application. In that case you still need the IIS-side request limit configured appropriately.

So a realistic troubleshooting order is:

1. check the application framework settings
2. check IIS request filtering if IIS is involved
3. check any reverse proxy or load balancer limits
4. confirm the request is not timing out during slow uploads

If you skip the hosting layer, you often end up increasing a limit that the request never reaches.

Keep the Upload Path Reasonable

Raising the limit is only half the job. Large uploads have operational consequences:

• more memory pressure if buffering is used
• longer request times
• more risk from abusive uploads
• more need for virus scanning and content validation

If files are very large, consider streaming them directly to disk or object storage instead of buffering everything in memory.

Common Pitfalls

A common mistake is changing only one limit and assuming the upload path has only one choke point. IIS, ASP.NET, and multipart parsing can all enforce limits.

Another mistake is copying an ASP.NET Framework web.config solution into an ASP.NET Core app and expecting it to control Kestrel behavior.

People also often forget timeouts. A larger allowed size does not help if the request times out before the upload finishes.

Finally, do not raise upload limits without validating file type, size, and destination handling. Bigger uploads increase attack surface.

Summary

• The effective upload limit in ASP.NET usually comes from several layers, not one setting
• ASP.NET Framework commonly needs both maxRequestLength and IIS maxAllowedContentLength
• ASP.NET Core commonly needs Kestrel or form limits adjusted in code
• If IIS or another proxy is in front, its request limit can reject the upload before the app sees it
• Large uploads should be paired with streaming, validation, and sensible timeout settings
• Change the limit in the layer that is actually rejecting the request, not just the first example you find