You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The HTTP specification (RFC 7230) states that when Transfer-Encoding: chunked is used, the Content-Length header must not be present in the same message. Including both headers causes ambiguity in how the body length is determined and violates the HTTP/1.1 standard.
Current Behavior:
When the Transfer-Encoding header includes chunked (alone or in combination with other encodings like gzip), the Content-Length header is still being sent in some cases. This results in undefined behavior and may cause protocol errors for HTTP clients or servers.
Expected Behavior:
If Transfer-Encoding: chunked is present, the Content-Length header should be omitted.
For other Transfer-Encoding values (e.g., gzip, compress, deflate) without chunked, the Content-Length can be included.
Send an HTTP request or response with Transfer-Encoding: chunkedandContent-Length set.
Observe that both headers are sent.
Impact:
This issue violates HTTP/1.1 specifications and can lead to inconsistent handling of the response body by clients or servers, causing errors or unexpected behaviors.
Proposed Fix:
Add a validation step to ensure that if Transfer-Encoding contains chunked, the Content-Length header is not included.
Log or throw an error if both headers are detected.
The text was updated successfully, but these errors were encountered:
The HTTP specification (RFC 7230) states that when
Transfer-Encoding: chunked
is used, theContent-Length
header must not be present in the same message. Including both headers causes ambiguity in how the body length is determined and violates the HTTP/1.1 standard.Current Behavior:
When the
Transfer-Encoding
header includeschunked
(alone or in combination with other encodings likegzip
), theContent-Length
header is still being sent in some cases. This results in undefined behavior and may cause protocol errors for HTTP clients or servers.Expected Behavior:
Transfer-Encoding: chunked
is present, theContent-Length
header should be omitted.Transfer-Encoding
values (e.g.,gzip
,compress
,deflate
) withoutchunked
, theContent-Length
can be included.Examples of Valid Cases:
✅
Transfer-Encoding: chunked
(noContent-Length
)✅
Transfer-Encoding: gzip
+Content-Length: 100
✅
Transfer-Encoding: deflate
+Content-Length: 256
Examples of Invalid Cases:
❌
Transfer-Encoding: chunked
+Content-Length: 100
❌
Transfer-Encoding: gzip, chunked
+Content-Length: 150
Steps to Reproduce:
Transfer-Encoding: chunked
andContent-Length
set.Impact:
This issue violates HTTP/1.1 specifications and can lead to inconsistent handling of the response body by clients or servers, causing errors or unexpected behaviors.
Proposed Fix:
Transfer-Encoding
containschunked
, theContent-Length
header is not included.The text was updated successfully, but these errors were encountered: