Angular/Express POST request failing with 403 with large payload

I have an angular application with a Node/Express backend, it's a long running application that has been working for years but we didn't realize until recently that a couple of endpoints are broken (both returning a 403 error).

These are specifically Create/Update endpoints from a specific node service, both are POST requests defined sort of like this:

getData(market: string): Observable<any> {
const url = `my-server-url/getData?id=${id}`;
return this.http.get<any>(url);
}

updateData(request: any): Observable<any> {
const url = `my-server-url/update`;
return this.http.post(url, request, { responseType: 'json' });
}

createData(request: any): Observable<any> {
const url = `my-server-url/create`;
return this.http.post(url, request, { responseType: 'json' });
}


Only the create and update ones are failing but I'm including the get one as well to mention that it is working even tho it has very little differences (differences being that it is a GET request and not a POST, the explicit responseType and of course the payload)

The payload is one of my suspects as why it is failing, it contains a JSON object that is stringified and escaped and that is somewhat large (around 18K characters) but it is not sent as a multipart file, just as a large string property in the body obj, let's say it looks like this:

{
id: "12345"
name: "John Doe"
age: 30
email: "test@example.com"
//this is the large one
translationFile: "{\"greeting\":\"Hello, {{ name }}!\",\"farewell\":\"Goodbye, {{ name }}!\",\"age_message\":\"You are {{ age }} years old.\",\"email_message\":\"Your email is {{ email }}.\"}"
}


I understand that 403 code is "forbidden" and it should mean an auth problem of some sort but I find it very weird that the GET and many other requests consume the same service and don't get the 403 response, given that the use the same auth method (bearer token) and else; and of course I've checked and no explicit 403 exception error throw can be found on the express app.

A couple other weird behaviors:

• the request has no problem going thru on my local machine, only fails once deployed to our test environments (I've tried running the front-end on my machine and getting the backend on both my machine and on the test server, both going thru with no errors)
• Thinking of this behavior mismatch between local and test env I updated node, express, angular and every significant dependency version and they match on my machine and the test environment
• I tried mocking the translationFile on the payload to shorter ones and the post successfully updates/creates the data
• Whenever I check the logs for the backend service it seems as the request never leaves my browser at all, there's no trace of the 403

Thinking the payload might be the culprit I checked on the express app and it has this configuration:

app.use(bodyParser.json({ limit: '50mb' }));


Even with the 18K characters on the payload it does not hit the 50mb limit so I'm all out of ideas, where could I go and look trying to debug this?

Thanks in advance for your help!

Continue reading...