If you have seen the error "the request was rejected because its size exceeds the configured maximum" in a Spring Boot application running on Tomcat, it means the incoming HTTP request body or multipart upload is larger than what the server is configured to accept. This is a security feature that prevents clients from overwhelming the server with excessively large payloads. This article explains where the limits are set, how to configure them at both the Tomcat and Spring levels, and how to handle the error gracefully.

Why Request Size Limits Exist

Without size limits, a malicious client could send a multi-gigabyte request body that exhausts the server's memory or disk space. This is a basic denial-of-service vector. Both Tomcat and Spring enforce separate limits, and the request must satisfy both to be accepted.

Tomcat-Level Configuration

Tomcat enforces its own limits on POST data and request body size. These are configured in server.xml or through Spring Boot properties.

maxPostSize

This property controls the maximum size of POST request data parsed by Tomcat. The default is 2 MB (2097152 bytes). Setting it to -1 removes the limit entirely.

1<!-- In Tomcat's server.xml -->
2<Connector port="8080" protocol="HTTP/1.1"
3           maxPostSize="10485760" />
4<!-- 10 MB limit -->

In a Spring Boot application, you can set this through application.properties.

server.tomcat.max-http-form-post-size=10MB

maxSwallowSize

When Tomcat rejects a request because it exceeds the size limit, it needs to decide what to do with the remaining bytes the client is still sending. maxSwallowSize controls how many bytes Tomcat will read and discard before closing the connection. The default is 2 MB.

server.tomcat.max-swallow-size=20MB

If the remaining bytes exceed this threshold, Tomcat abruptly closes the connection, which can cause the client to see a broken pipe or connection reset error instead of a clean HTTP response.

Spring-Level Configuration

Spring has its own multipart upload limits that are separate from Tomcat's. These are the settings that most commonly trigger the error for file uploads.

Multipart Properties

1# Maximum size of a single uploaded file
2spring.servlet.multipart.max-file-size=10MB
3
4# Maximum size of the entire multipart request (all files + form fields)
5spring.servlet.multipart.max-request-size=50MB

The defaults are 1 MB for max-file-size and 10 MB for max-request-size. If either limit is exceeded, Spring throws a MaxUploadSizeExceededException.

Java Configuration Alternative

You can also configure multipart settings programmatically.

1@Configuration
2public class MultipartConfig {
3
4    @Bean
5    public MultipartConfigElement multipartConfigElement() {
6        MultipartConfigFactory factory = new MultipartConfigFactory();
7        factory.setMaxFileSize(DataSize.ofMegabytes(10));
8        factory.setMaxRequestSize(DataSize.ofMegabytes(50));
9        return factory.createMultipartConfig();
10    }
11}

Both Limits Must Be Satisfied

A common source of confusion is that Tomcat and Spring enforce their limits independently. Even if you increase the Spring multipart limit to 50 MB, the request will still be rejected if Tomcat's maxPostSize is still at its 2 MB default. You need to raise both limits.

1# Tomcat level
2server.tomcat.max-http-form-post-size=50MB
3
4# Spring level
5spring.servlet.multipart.max-file-size=50MB
6spring.servlet.multipart.max-request-size=50MB

Handling the Error Gracefully

When a request exceeds the size limit, the user deserves a clear error message rather than a raw stack trace. Use a @ControllerAdvice to catch the exception and return a proper HTTP response.

1@ControllerAdvice
2public class FileUploadExceptionHandler {
3
4    @ExceptionHandler(MaxUploadSizeExceededException.class)
5    public ResponseEntity<Map<String, String>> handleMaxSizeException(
6            MaxUploadSizeExceededException ex) {
7
8        Map<String, String> error = new HashMap<>();
9        error.put("error", "File too large");
10        error.put("message", "The uploaded file exceeds the maximum allowed size of 10 MB");
11
12        return ResponseEntity
13                .status(HttpStatus.PAYLOAD_TOO_LARGE)
14                .body(error);
15    }
16}

This returns a 413 Payload Too Large status code with a clear JSON error message instead of a 500 Internal Server Error.

Nginx or Reverse Proxy Limits

If your Spring Boot application sits behind a reverse proxy like Nginx, the proxy also has its own request size limit. Nginx defaults to 1 MB via the client_max_body_size directive.

1server {
2    client_max_body_size 50M;
3
4    location / {
5        proxy_pass http://localhost:8080;
6    }
7}

If Nginx rejects the request before it reaches Tomcat, the user sees a 413 error from Nginx and your application never even receives the request. Always check the proxy configuration alongside the application configuration.

Common Pitfalls

Only increasing one limit. The request must pass through the reverse proxy, Tomcat, and Spring multipart limits. Raising just one while leaving the others at their defaults will not fix the problem.

Setting limits to unlimited in production. Removing size limits entirely (by setting values to -1 or very large numbers) opens the door to denial-of-service attacks. Set limits to the largest file size your application legitimately needs to handle, plus a small margin.

Not checking the error message carefully. The error message usually tells you which limit was exceeded. "The field file exceeds its maximum permitted size" comes from Spring's multipart configuration. "The request was rejected because its size exceeds the configured maximum" typically comes from Tomcat or the CommonsMultipartResolver.

Forgetting about maxSwallowSize. If you increase maxPostSize but leave maxSwallowSize at the default, Tomcat may close the connection before the client finishes sending data for requests that fall between the two thresholds. This produces confusing connection-reset errors on the client side.

Not setting proper client-side validation. Relying solely on server-side rejection gives a poor user experience, especially for large file uploads that take minutes to transfer. Add client-side file size validation in JavaScript to reject oversized files before the upload begins.

Summary

The "request rejected because of its size" error in Spring/Tomcat applications is caused by request body or file upload limits set at the Tomcat, Spring, or reverse proxy level. To fix it, increase server.tomcat.max-http-form-post-size, spring.servlet.multipart.max-file-size, and spring.servlet.multipart.max-request-size to appropriate values. If you use a reverse proxy, increase its limit as well. Handle the exception gracefully with a @ControllerAdvice that returns a clear error response. Always keep limits at reasonable values rather than removing them entirely.