Last week one of our third party integrator who is using our web api has asked what is the maximum number of ids they can query.
In this api they use, they send (Post) array of ids and in return, API provide status of those records. So they wanted to know what is the maximum limit they can send in the ID array.
I didn't had a answer straight away. That got me thinking.
Ids are in body, because it is a post request. So "maxQueryString" limit will not comes into play as far as I can see.
I have done bit of Googling and found out there is a setting in IIS, which filter requests. It was called "maxAllowedContentLength". As I found out this is a security setting which limits some one sending huge requests. This setting can be found in system.webServer/security/requestFiltering section. If you looking in the web.config file you can see it in following section:
This setting is there to prevent DoS attacks.
Value in this setting is in bytes. Default value seems to be 30,000,000 (30 million) bytes, which is approximately 28.6 MB. Most of time in production web servers, we tends to go much lower limit.
When you consider 28.6 MB, it can accommodate large number of IDs for our supplier, but on the other hand in order to full fill that request, back end (data stores) must work very hard. There fore, I have advice not to send too many Ids in there request and split their request to several sub request (paging) in order to prevent data store servers overwhelming.
If you exceed "maxAllowedContentLength" limit, you will get HTTP 404.13 - Request Entity Too Large.