File uploading using POST request on Azure Web app results in 403 forbidden

For a web app using a Docker image running on an Azure Webb App service (ASP-prod-a1e6 (P1v3: 1)) I want to upload a file via a REST service.

I use the following request

POST {{ baseUrl }}/api/update/project
Content-Type: multipart/form-data; boundary=boundary
Accept: */*
Authorization: Bearer {{ bearerToken }}

--boundary
Content-Disposition: form-data; name="file"; filename="project_content.json"

< project_content.json
--boundary

And I am getting the following response

HTTP/1.1 403 Forbidden
Content-Length: 0
Connection: close
Date: Thu, 15 Jun 2023 09:13:16 GMT

<Response body is empty>Response code: 403 (Forbidden); Time: 74ms (74 ms); Content length: 0 bytes (0 B)

The call works successfully for small files (< 128kB) but my files are 210kB so there must be a limit somewhere. I am not using any firewall on Azure. I also updated the CORS policy to * so all hosts are enabled

I tried to find a place where the increase the file upload limits and uploading files via the HTML frontent works fine

If you want to change the request file size limit in the web.config, here's what you need to do:

1. Open the Azure portal and navigate to your App Service.

2. In the left-hand menu, select Development Tools > Advanced Tools. This will open the Kudu console in a new tab.

3. In the Kudu console, select Debug Console > CMD to open a command prompt.

4. Navigate to the site directory by running the following command:

   cd site
   

5. Locate the web.config file in the wwwroot directory and open it for editing. You can use the edit command to open the file in the console, or you can download it and edit it locally.

6. Add the following configuration section to the web.config file to increase the maximum request size:

   <system.webServer>
     <security>
       <requestFiltering>
         <requestLimits maxAllowedContentLength="104857600" />
       </requestFiltering>
     </security>
   </system.webServer>
   

   In this example, the maxAllowedContentLength attribute is set to 104857600 bytes, which is equivalent to 100 MB. You can adjust this value to suit your needs.

7. Save the changes to the web.config file and restart your App Service to apply the new configuration.

I found the cause of the problem. As mentioned before has editing web.config no effect for this type of containers as these are Docker instances and the request was already caught on 1 of the receiving servers.

It turned out that the "Incoming Client Certificates" setting (via Configuration > General Settings) blocks the request in case this is set to "Optional" and the request has a larger body

Switching this setting to "Ignore" solved the issue and now all requests are answered by the Docker container