Why client_max_body_size is not taking effect in Nginx

If changing client_max_body_size does not fix an upload failure, first identify which component rejects the request. A more specific Nginx location may override the setting, the running instance may still use the old configuration, or a CDN, gateway, or application may impose a smaller limit.

Check the location that actually handles the request

http {
    client_max_body_size 10m;

    server {
        listen 80;
        client_max_body_size 20m;

        location /upload {
            client_max_body_size 100m;
        }
    }
}

These are configuration-context examples; retain your existing upload handler. A child context inherits the parent setting unless it declares its own value. Identify the selected virtual host and location, including regex locations and internal redirects.

sudo nginx -T

Inspect the loaded includes for every client_max_body_size declaration. Searching /etc/nginx alone can miss a custom configuration path. Keep the configuration dump private.

Test and reload the correct instance

sudo nginx -t && sudo systemctl reload nginx

For a non-systemd or container deployment, use its normal reload mechanism. Check the error log after the reload; a failed reload leaves the old configuration serving requests.

Find the source of the rejection

A Server: nginx header or a familiar HTML error page is a clue, not proof. A proxy can forward another server's error or replace its body. Match the request's timestamp, path, status, and request identifier across the CDN, Nginx, and application logs.

Check the actual product and plan limits for any CDN or load balancer in front. Increasing Nginx's limit cannot override a limit enforced earlier in the path.

Match application limits to the intended upload

For a PHP endpoint accepting a 100 MiB file, allow room for multipart fields and boundaries in the total POST limit:

upload_max_filesize = 100M
post_max_size = 110M
memory_limit = 256M

Set Nginx's request-body limit above the complete expected multipart body too. Memory requirements depend on how the application processes the upload; the example memory setting is not a universal sizing rule.

In Express, express.json({ limit: '100mb' }) controls JSON bodies. It does not configure multipart file uploads; configure the multipart middleware separately. Other frameworks likewise distinguish file size, total body size, and parser limits.

FAQ

What is the default?

client_max_body_size defaults to 1m, or 1 MiB (1,048,576 bytes). It limits the whole request body, not just the file payload.

What does a value of zero mean?

0 disables this Nginx size check. Other layers can still reject the upload, and unbounded bodies require deliberate resource controls.

How should multi-gigabyte uploads work?

Consider resumable or chunked application uploads, or direct object-storage uploads using appropriately scoped presigned URLs. Validate authorization, per-object limits, and completion handling as part of that design.

Reference: client_max_body_size.