Apache提交超过8186字节时出现403错误排查求助

当POST请求内容超过8186字节时，服务器返回403 Forbidden错误，内容小于8187字节的POST请求可正常执行。

测试命令 #

curl -d "post=`printf '%0.s0' {1..8186}`" -X POST https://<server-name>/index.php/start/post_test
# 输出：2023-04-02 09:34:51 Length of post is : 8186%

curl -d "post=`printf '%0.s0' {1..8187}`" -X POST https://<server-name>/index.php/start/post_test
# 输出：
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
</body>
</html>

对应PHP代码 #

public function post_test(): void
{
  $post = $this->input->post('post');
  echo (new DateTime(NULL, new DateTimeZone('Australia/Hobart')))->format(CKD_DATETIME_MYSQL) . ' Length of post is : ' . strlen($post);
}

服务器详情 #

$uname -a
Linux mrffpa5e1d0 4.18.0-425.13.1.el8_7.x86_64 #1 SMP Thu Feb 2 13:01:45 EST 2023 x86_64 x86_64 x86_64 GNU/Linux

$httpd -v
Server version: Apache/2.4.37 (Red Hat Enterprise Linux)
Server built:   Jan 31 2023 12:55:09

$ php -v
PHP 7.4.30 (cli) (built: Jun  7 2022 08:38:19) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies

$php -i | grep post
post_max_size => 128M => 128M

$ php -i | grep max_input_vars
max_input_vars => 5000 => 5000

$sudo grep -ir security_module /etc/httpd
(no output)
$httpd -l
Compiled in modules:
  core.c
  mod_so.c
  http_core.c

$free -m
              total        used        free      shared  buff/cache   available
Mem:           1780         697         318           0         765         924
Swap:             0           0           0

$ getsebool -a | grep post
postfix_local_write_mail_spool --> on
postgresql_can_rsync --> off
postgresql_selinux_transmit_client_label --> off
postgresql_selinux_unconfined_dbadm --> on
postgresql_selinux_users_ddl --> on
selinuxuser_postgresql_connect_enabled --> off

$ getsebool -a | grep httpd
httpd_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_check_spam --> off
httpd_can_connect_ftp --> off
httpd_can_connect_ldap --> off
httpd_can_connect_mythtv --> off
httpd_can_connect_zabbix --> off
httpd_can_network_connect --> on
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> on
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
httpd_can_sendmail --> off
httpd_dbus_avahi --> off
httpd_dbus_sssd --> off
httpd_dontaudit_search_dirs --> off
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> off
httpd_execmem --> off
httpd_graceful_shutdown --> off
httpd_manage_ipa --> off
httpd_mod_auth_ntlm_winbind --> off
httpd_mod_auth_pam --> off
httpd_read_user_content --> off
httpd_run_ipa --> off
httpd_run_preupgrade --> off
httpd_run_stickshift --> off
httpd_serve_cobbler_files --> off
httpd_setrlimit --> off
httpd_ssi_exec --> off
httpd_sys_script_anon_write --> off
httpd_tmp_exec --> off
httpd_tty_comm --> off
httpd_unified --> off
httpd_use_cifs --> off
httpd_use_fusefs --> off
httpd_use_gpg --> off
httpd_use_nfs --> off
httpd_use_opencryptoki --> off
httpd_use_openstack --> off
httpd_use_sasl --> off
httpd_verify_dns --> off

提问 #

猜测可能是防火墙设备的相关设置导致了该问题，拥有此服务器的root权限，但不了解网络架构。请问有什么方法可以解除此限制，允许更大的POST请求？

1. 检查本地Apache与安全模块 #

• 验证mod_security加载状态：执行httpd -M | grep security，如果返回security2_module (shared)，说明加载了mod_security。找到其配置文件（通常在/etc/httpd/conf.d/mod_security.conf），调整SecRequestBodyLimit和SecRequestBodyNoFilesLimit参数（比如设为10485760即10M），重启Apache。
• 检查Apache核心限制：在httpd.conf或虚拟主机配置中查找LimitRequestBody指令，若设置为8192（8KB），注释掉或调整为更大值，重启Apache。

2. 排查本地防火墙规则 #

• 执行firewall-cmd --list-all查看firewalld规则，确认是否有针对请求长度的限制；或者用iptables -L -n -v检查iptables规则，是否存在--length相关的过滤条目，如有则删除或调整。

3. 验证本地请求是否正常 #

在服务器本地发起大POST请求，绕过前端网络设备：

curl -d "post=`printf '%0.s0' {1..10000}`" -X POST http://localhost/index.php/start/post_test

如果本地请求正常，说明问题出在前端网络设备（硬件防火墙、WAF、负载均衡等）；如果本地也返回403，继续排查本地配置。

4. 前端网络设备排查 #

• 若服务器前有NGINX反向代理，检查nginx.conf或站点配置中的client_max_body_size参数，调整为合适大小后重启NGINX。
• 联系网络管理员或云服务商，确认前端防火墙/WAF是否设置了POST请求长度阈值，申请调整该限制。

内容的提问来源于stack exchange，提问作者pgee70