Hi Railway team,

We're seeing large multipart/form-data uploads fail at your edge with a 403 whose body is just the

plaintext word Forbidden (not from our app — our own error responses are structured JSON with

different messages, e.g. "Invalid X-Auth-Token").

Service: app (public domain: appup.railway.app, also mapped via custom domain)

Reproduction:

curl --location 'https://app.up.railway.app/api/upload' \

--header 'x-auth-token: ***' \

--form 'app_file=@"app.apk"' \

--form 'app_name="qa-android"' \

--form 'app_version="4.5.2"'

We tested the same endpoint/token/flow with two file sizes:

• 125MB file → succeeds (200, full JSON response with build metadata)
• 204MB file → fails every time, curl: (92) HTTP/2 stream 1 was not closed cleanly: CANCEL (err

8), response body Forbidden, status 403. The connection is reset by the server side partway

through the upload (how far varies by attempt, consistent with a byte-count or timing-based

cutoff), not by our client.

So the real threshold is somewhere between 125MB and 204MB.

What we've ruled out:

• Not an app-level error — our app has no size-based logic at all, and its own 403 responses have

a different, structured body.

• Not specific to our custom domain — reproduces identically on the bare *.up.railway.app domain,

bypassing our DNS/custom domain setup entirely.

• Not tied to specific form field values — retried with different app_name/app_version on the

204MB file, still blocked.

This contradicts the "no request body size limit" note in your docs, and looks like a

Cloudflare-backed max-upload-size restriction (or a WAF custom rule keyed on body size) on your

edge. Could you confirm:

1. Whether there's a body size limit enforced on our project/zone, and its exact value?
2. Whether it's configurable (raised) for our use case, since we need to support app builds up to

a few hundred MB?

Happy to share more request_ids/timestamps if useful for tracing.

Thanks!