Case study: catching a 5 MB PDF upload bug before production

Background

A document portal advertised “PDFs up to 5 MB.” Marketing copy was clear; the implementation was not. Users reported intermittent failures near the limit, but support could not reproduce them because attachments in tickets were re-compressed in email threads.

The QA lead asked for deterministic fixtures: same filename, same magic bytes, three sizes — 5,242,879 bytes (under), 5,242,880 bytes (exact), and 5,242,881 bytes (over).

What we did in staging

Generated the three PDFs client-side (no server round-trip) using a shareable preset link so every engineer pulled identical blobs.
Uploaded through the same CDN path production uses, with browser devtools throttling disabled first, then with 3G throttling to observe timeout UI separately from size validation.
Logged server-side Content-Length, stored object size, and the user-facing error string for each attempt.

What broke

The “exact limit” file uploaded successfully but arrived at storage as 5,242,368 bytes — 512 bytes short. Root cause: an intermediate image optimization microservice read the PDF stream as a generic binary, attempted a no-op “normalize” pass, and rewrote the buffer with a fixed header block that dropped trailing bytes. The API gateway still returned 200 because the downstream call succeeded.

The “one byte over” case returned a generic “Upload failed” toast with no mention of size — indistinguishable from network blips.

Fixes shipped

Skip optimization for application/pdf unless explicitly requested.
Compare declared size against stored size; alert if delta > 0 for non-streaming uploads.
Return structured error codes: FILE_TOO_LARGE with the configured max in the payload.

Takeaways for your team

Boundary testing is not “upload a big PDF from your Downloads folder.” You need exact byte counts and a table of expected outcomes. Bookmark presets for your tier limits and re-run the matrix on every storage pipeline change.

Related playbook: 5 MB PDF upload boundary scenario.