AspMaxRequestEntityAllowed - increasing the value in IIS 6.0

Hello Friends

My site is under a shared hosting plan on Windows 2003 Server.

Problem:
a) File upload greater than 200KB not possible due the settings of AspMaxRequestEntityAllowed value.

My Questions:
1) My hosting provider is apprehensive of changing the settings. Does the change in the AspMaxRequestEntityAllowed value on the higher side (10 MB) really be a threat to security? Advice.

2) Why does the same problem does not arise when I am using the Asp upload component?

Can you please help me out and provide a solution to this ASAP?

Thanks,
Bithika

the MetaBase.xml file on win 2003 is the file that contain's the PURE ASP UPLOAD limit in the AspMaxRequestEntityAllowed entry which is set to 2048 bytes by default. Also if there are large file u need to also change the value for AspBufferingLimit, which is set at 4MB.

nearly all ISP hosts won't change these values.

your ISP will probably have a preferred upload component u can use as these have greater security settings avaiable that can be set to stem hacking.

with an ASPupload components they don't use the MetaBase.xml file as a reference point, the upload file is controlled/uploaded by the installed components rules.

but for ur reference here is how u change the limit:

Make sure the IIS web server is not restricting the size of ASP uploads. IIS 6
(Windows Server 2003) has a limit of 200 KB for ASP requests in general and file
uploads in particular. To remove this limitation in IIS 6 you need to edit the Metabase
file, which can be found at c:\Windows\System32\Inetsrv\MetaBase.xml.

Follow these steps: go to IIS and right click the server, select properties, and check
the box "Allow changes to MetaBase configuration while IIS is running"; if after this
step the metabase file is still locked, try turning off IIS or even restarting the machine
in safe mode; open the file in an editor; the variable AspMaxRequestEntityAllowed
limits the number of bytes in the page request (by default 200KB); change the value
to 1073741824 (unlimited) or to a limit of your choice; check whether the same
variable shows up in other places in the file.