The body of a request is the part that carries form data, JSON or an uploaded file. Servers cap it so that one client cannot send gigabytes and fill the memory or disk. In nginx the setting is client_max_body_size, in PHP it is post_max_size and upload_max_filesize, and cloud load balancers and WAFs have their own maximums.
Each component in the chain may have a different value, and the smallest one wins. A WAF might inspect only the first part of a large body, while the application accepts the whole thing, and that gap is used in bypass attempts.
Set the limit as low as your real use needs. A contact form does not need to accept 100 MB, and a public endpoint that only takes small JSON does not need more than a few kilobytes. Lower limits shrink what an attacker can send and make abuse easier to notice.
Make sure the limits match at every layer, and return a clear error, such as 413, when a request is too large.