Why does a Spring Boot MultipartFile upload fail past a few MB, what are the default limits, how do you raise them, and why is raising the limit the wrong fix for truly large uploads

package com.bank.upload.controller;

import org.springframework.web.multipart.MultipartFile;
import org.springframework.web.multipart.MaxUploadSizeExceededException;

public class UploadController {

    // When Rajesh uploads a 50 MB file with default limits:
    // Tomcat rejects it before the controller even sees it.
    // Exception: MaxUploadSizeExceededException
    //   caused by: SizeLimitExceededException
    //   "the request was rejected because its size (50000000)
    //    exceeds the configured maximum (1048576)"

    public String handleUpload(MultipartFile file) {
        // Never reached for files > 1 MB with defaults
        return "Uploaded: " + file.getOriginalFilename();
    }
}

# application.yml
spring:
  servlet:
    multipart:
      max-file-size: 50MB
      max-request-size: 60MB
      file-size-threshold: 256KB  # spill to disk above this

package com.bank.upload.config;

import jakarta.servlet.MultipartConfigElement;
import org.springframework.boot.web.servlet.MultipartConfigFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.util.unit.DataSize;

@Configuration
public class MultipartConfig {

    @Bean
    public MultipartConfigElement multipartConfigElement() {
        MultipartConfigFactory factory = new MultipartConfigFactory();
        factory.setMaxFileSize(DataSize.ofMegabytes(50));
        factory.setMaxRequestSize(DataSize.ofMegabytes(60));
        factory.setFileSizeThreshold(DataSize.ofKilobytes(256));
        return factory.createMultipartConfig();
    }
}

package com.bank.upload.antipattern;

import org.springframework.web.multipart.MultipartFile;

public class RaiseLimitWrong {

    // WRONG: raised limit to 5 GB, but still calls getBytes()
    public void handleUpload(MultipartFile file) throws Exception {
        byte[] data = file.getBytes(); // 5 GB in heap for ONE request
        // A handful of concurrent uploads = instant OutOfMemoryError
        // The JVM crashes, taking down ALL other users' requests.
    }
}

package com.bank.upload.service;

import org.springframework.web.multipart.MultipartFile;
import java.io.InputStream;
import java.io.OutputStream;
import java.nio.file.Files;
import java.nio.file.Path;

public class StreamingUploadService {

    // CORRECT: stream in chunks, memory stays bounded
    public void handleUpload(MultipartFile file, Path destination) throws Exception {
        try (InputStream in = file.getInputStream();
             OutputStream out = Files.newOutputStream(destination)) {
            byte[] buffer = new byte[8192]; // 8 KB at a time
            int bytesRead;
            while ((bytesRead = in.read(buffer)) != -1) {
                out.write(buffer, 0, bytesRead);
            }
        }
        // Only 8 KB in memory at any time, regardless of file size
    }

    // Or pipe directly to S3:
    // s3Client.putObject(putRequest,
    //     RequestBody.fromInputStream(file.getInputStream(), file.getSize()));
}

package com.bank.upload.service;

public class UploadStrategySelector {

    public String selectStrategy(long sizeBytes) {
        if (sizeBytes < 10_000_000) {
            return "MultipartFile with getBytes() (simple, safe for small files)";
        } else if (sizeBytes < 500_000_000) {
            return "MultipartFile with getInputStream() (stream, bounded memory)";
        } else {
            return "Presigned URL direct-to-S3 (server never touches bytes)";
        }
    }
}

package com.bank.upload.exception;

import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.multipart.MaxUploadSizeExceededException;

@ControllerAdvice
public class UploadExceptionHandler {

    @ExceptionHandler(MaxUploadSizeExceededException.class)
    public ResponseEntity<String> handleMaxUploadSize(
            MaxUploadSizeExceededException ex) {
        return ResponseEntity
            .status(HttpStatus.PAYLOAD_TOO_LARGE) // 413
            .body("File too large. Maximum allowed size is 50 MB.");
    }
}