diff --git a/docs/changelog.md b/docs/changelog.md index 1de4790430..3eb4c0b8f0 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -4,6 +4,7 @@ Unreleased - Added the parameter `matchbox.fhir.context.ssrfProtectionEnabled` to control the new HAPI SSRF protection mechanism - Update HAPI FHIR to 8.10.1 - Fix the GUI not able to send resources larger than 64 KiB (#542) +- Fix requests larger than 2 MiB being rejected by Undertow (`UT000020`): the maximum request body size is now 100 MB, configurable with `server.undertow.max-http-post-size` (#543) 2026/07/01 Release 4.1.11 diff --git a/docs/matchbox-server.md b/docs/matchbox-server.md index f2cd4eb25d..2be03ddaf5 100644 --- a/docs/matchbox-server.md +++ b/docs/matchbox-server.md @@ -75,6 +75,16 @@ hapi: Some more configuration parameters used by validation are described in the [Validation](validation.md#configuration-parameters) page. +### Maximum request size + +Matchbox runs on Undertow, which rejects request bodies larger than 2 MiB by default with +`RequestTooBigException: UT000020: Connection terminated as request was larger than 2097152`. +Matchbox raises that limit to 100 MB; if you have to send larger resources, increase +`server.undertow.max-http-post-size` (e.g. with the environment variable +`SERVER_UNDERTOW_MAX_HTTP_POST_SIZE`). The value must be positive, Undertow cannot be configured for +unlimited request bodies through Spring Boot. Note that a reverse proxy in front of Matchbox may +enforce its own, smaller limit. + ## Read-only mode {: #read-only} When enabling `httpReadOnly`, the server will reject any operation that would modify its state. diff --git a/matchbox-server/src/main/resources/application.yaml b/matchbox-server/src/main/resources/application.yaml index 8d8987f54e..61838f0fd7 100644 --- a/matchbox-server/src/main/resources/application.yaml +++ b/matchbox-server/src/main/resources/application.yaml @@ -53,6 +53,12 @@ spring: server: servlet: context-path: /matchboxv3 + undertow: + # Undertow rejects request bodies larger than 2 MiB by default (UndertowOptions.MAX_ENTITY_SIZE), + # which is too small for FHIR resources such as documents or large bundles. Override with the + # environment variable SERVER_UNDERTOW_MAX_HTTP_POST_SIZE if needed; the value must be positive, + # Undertow cannot be configured for unlimited request bodies through Spring Boot. + max-http-post-size: 100MB management: endpoint: health: