SECRET_FILE_SIZE does not work as expected

[casperklein]

Description

With SECRET_FILE_SIZE=10, a file upload of a 10MB file fails.

Relevant log output:

{"level":30,"time":1692055043495,"pid":19,"hostname":"hemmelig","reqId":"req-9","res":{"statusCode":413},"err":{"type":"FastifyError","message":"Request body is too large","stack":"FastifyError: Request body is too large\n    at rawBody (/home/node/hemmelig/node_modules/fastify/lib/contentTypeParser.js:207:16)\n    at ContentTypeParser.run (/home/node/hemmelig/node_modules/fastify/lib/contentTypeParser.js:167:5)\n    at handleRequest (/home/node/hemmelig/node_modules/fastify/lib/handleRequest.js:41:33)\n    at runPreParsing (/home/node/hemmelig/node_modules/fastify/lib/route.js:528:5)\n    at next (/home/node/hemmelig/node_modules/fastify/lib/hooks.js:168:7)\n    at handleResolve (/home/node/hemmelig/node_modules/fastify/lib/hooks.js:185:5)","name":"FastifyError","code":"FST_ERR_CTP_BODY_TOO_LARGE","statusCode":413},"msg":"Request body is too large"}
{"level":30,"time":1692055043496,"pid":19,"hostname":"hemmelig","reqId":"req-9","res":{"statusCode":413},"responseTime":3.1347219944000244,"msg":"request completed"}
{"level":30,"time":1692055073172,"pid":19,"hostname":"hemmelig","reqId":"req-a","req":{"method":"GET","url":"/","hostname":"localhost:3000","remoteAddress":"127.0.0.1","remotePort":59382},"msg":"incoming request"}

Screenshots

No response

Additional information

I noticed, that a SECRET_FILE_SIZE value of 19 or higher is needed, for a 10MB file upload.

[bjarneo]

Yes, this might be due to the file being encoded in the frontend before being shipped to the server, so it is kind of a bug, but not really. I think it should be documented better.

[casperklein]

I think you are right. When uploading the 10MB test file, the transferred bytes are way more than 10MB.

From the HTTP request headers:

Content-Length: 18642131
Content-Type: application/json

Uploading the file json encoded seems to be the cause. I looked at other solutions for comparison.

filebrowser uses Content-Type: application/octet-stream. When uploading the 10MB test file to filebrowser, only 10MB are transfered (unencoded).

[bjarneo]

It should not be due to the json body, but due to it is being encrypted before shipped to the backend. Here is how it works: #163 (comment)