Can anyone explain why limiting the maximum request body size is useful for preventing DoS attacks? ModSecurity defaults to 1MB for example with SecRequestBodyNoFilesLimit.
I guess I'm wondering why this matters that much since I thought usually DoS attacks (not necessarily DDoS ones) relied on something that was cheap for the attacker and expensive for the server being attacked.
If request bodies are limited to 1MB instead of 10MB for example, wouldn't the attacker just do ten 1MB requests in a row instead of one 10MB request in the same amount of time (assuming there wasn't some rate limiting of requests of course)?
Is this mainly because of application-level problems which may be cause a very large request body to have multiplicative effects with regards to being able to deny service (i.e. it's just a general precaution which may or may not be necessary depending on the application), or is there something I'm missing and it is always beneficial?