... I would have expected a simple config setting somewhere, but couldn't find anything.
The suggestions I found involve writing some OwinMiddleware for it, which would check the Content-Length header, or, if that is missing (e.g. chunked message), doing some wonky stuff with the underlying stream, and it looks buggy.
For other config settings one would expect from an HTTP server, there's this:
OwinHttpListener owinListener = appBuilder.Properties["Microsoft.Owin.Host.HttpListener.OwinHttpListener"] as OwinHttpListener;
owinListener.SetRequestQueueLimit(maxQueueLength);
owinListener.Listener.TimeoutManager.[...]
But nothing related to max message size.
I was hoping for something out-of-the-box for this. Am I missing something?
Like you, I wasn't able to find anything "in the box" to address this. But I had some success on my project using Damien Hickey's LimitsMiddleware - ultimately it's another OwinMiddleware, but at least you don't have to write it yourself.