Kestrel and Request Limits: Body Size, Header Timeout, Request Timeouts and Settings Against Slow Clients
By default Kestrel allows a 28.6 MB body, 30 seconds for headers and unlimited request duration, and a request timeout stops nothing unless the CancellationToken is carried. We read the real defaults from code and, with measurements, cover body, header, form and JSON limits, RequestHeadersTimeout and MinRequestBodyDataRate against slow clients, the request timeouts middleware and the split of work between Kestrel and the reverse proxy.
8 Nov 2026
·
10 min
·
4
