Skip to content

fix(api): disable default body parser on OpenAPI catch-all route#4770

Open
mutawakkilalallah wants to merge 1 commit into
Dokploy:canaryfrom
mutawakkilalallah:fix/openapi-body-parser-limit
Open

fix(api): disable default body parser on OpenAPI catch-all route#4770
mutawakkilalallah wants to merge 1 commit into
Dokploy:canaryfrom
mutawakkilalallah:fix/openapi-body-parser-limit

Conversation

@mutawakkilalallah

Copy link
Copy Markdown

Problem

Drop deployment uploads via the OpenAPI route (POST /api/drop-deployment) fail with HTTP 413 for zip files larger than ~1MB. This affects direct API consumers (curl, external tools, custom panels) but not the Dokploy frontend UI.

Fixes #4236

Root Cause

The OpenAPI catch-all handler at pages/api/[...trpc].ts was missing the Next.js API route config to disable the built-in body parser. Without bodyParser: false, Next.js applies its default JSON body parser with a 1MB size limit, which rejects multipart file uploads before they reach tRPC's content-type handler.

The tRPC-specific route at pages/api/trpc/[trpc].ts already had this config (lines 19-24), so uploads through the frontend UI worked correctly. Only the OpenAPI catch-all route was affected.

Fix

Added export const config = { api: { bodyParser: false } } to pages/api/[...trpc].ts, matching the existing config in the tRPC route handler.

Files Changed

  • apps/dokploy/pages/api/[...trpc].ts — added body parser config (6 lines added)

Manual Test Steps

  1. Start Dokploy locally or build a custom image
  2. Create an application with sourceType: drop
  3. Upload a zip < 1MB via direct API — verify success (no regression)
  4. Upload a zip > 1MB (e.g., 5MB) via direct API:
    curl -X POST http://<server>:3000/api/drop-deployment \
      -H "Authorization: Bearer <token>" \
      -F "applicationId=<id>" \
      -F "zip=@large-file.zip"
    → Verify no 413 error, deployment proceeds
  5. Upload via Dokploy UI drag-and-drop — verify still works (no regression)
  6. Confirm deployment record and logs appear normally in the dashboard

The OpenAPI catch-all handler at pages/api/[...trpc].ts was missing
the Next.js API route config to disable the built-in body parser.
Without bodyParser: false, Next.js applies its default JSON body
parser with a 1MB size limit, rejecting multipart file uploads
(e.g. drop deployment zips) before they reach tRPC's content-type
handler.

The tRPC-specific route at pages/api/trpc/[trpc].ts already had
this config, so uploads through the frontend UI worked correctly.
Only direct API calls via the OpenAPI route were affected.

Fixes Dokploy#4236
@dosubot dosubot Bot added size:XS This PR changes 0-9 lines, ignoring generated files. bug Something isn't working labels Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Drop deployment fails for zip uploads larger than about 1MB on direct :3000 access

1 participant