Unable to Download or Upload Large Files from the OAG-Managed Application

Users cannot download or upload large files from an Okta Access Gateway (OAG)- managed application because NGINX timeout settings close the connection prematurely. Modifying the `send_timeout` and `client_body_timeout` directives in the advanced policies resolves this issue. The download or upload terminates after some time without generating any errors in the logs.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)
• Large file download or upload
• High network latency
• Slow end-user machine

Network latency between the OAG server and the client prevents Okta from offloading data fast enough, causing the NGINX service to close the connection prematurely. The download or upload terminates after some time without generating errors in the logs. By default, the timeout settings use the following values in seconds:

client_body_timeout 10;
send_timeout 5;

How are the timeout directives configured in Okta Access Gateway?

Update the advanced policies in the OAG application configuration to increase the timeout directives.

• The send_timeout directive sets a timeout for transmitting a response to the client. The timeout applies only between two successive write operations, not for the transmission of the entire response. If the client receives nothing within this time, Okta closes the connection.
• Set the send_timeout value to a higher duration, such as five minutes, modifying the value to meet specific organizational needs:
  

  send_timeout 5m;

• If modifying the send_timeout directive does not resolve the issue, add the client_body_timeout directive. This defines a timeout for reading the client request body. The timeout applies only for a period between two successive read operations, not for the transmission of the entire request body. If a client transmits no data within this time, Okta terminates the request with a 408 (Request Timeout) error.
• Set the client_body_timeout value to a higher duration, such as five minutes, modifying the value to meet specific organizational needs:

  client_body_timeout 5m;