CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
A web server has a configuration file with 'LimitRequestBody 0' in Apache. What security risk does setting this to 0 create?
- A.LimitRequestBody 0 in Apache means no limit on request body size. An attacker can send arbitrarily large request bodies to exhaust server memory, disk space (if bodies are written to temp files), or cause timeout conditions - effectively a denial-of-service attack. A reasonable limit (e.g., 10MB for a general API, 100MB for file upload endpoints) should be configured
- B.LimitRequestBody 0 disables the request body entirely
- C.LimitRequestBody 0 only affects POST requests
- D.A 0 value automatically sets the limit to the system's maximum
Why A is correct
Apache's LimitRequestBody directive sets the maximum allowed size of an HTTP request body in bytes. Setting it to 0 means unlimited. Attackers can exploit this to: consume server RAM (if the body is held in memory), fill disk with temporary files, exhaust connection handling threads, and cause memory allocation failures. Nginx equivalent: client_max_body_size. Set appropriate limits per endpoint - a login API might need 1KB max; a file upload endpoint might need 50MB. Never leave the limit at 0 in production.
Know someone studying for Web App Fundamentals? Send them this one.