Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

uhttpd accepts requests with multiple Content-Length headers, prioritizing the last #8

Open
kenballus opened this issue Jun 26, 2024 · 0 comments

Comments

@kenballus
Copy link

From RFC 7230:

If a message is received without Transfer-Encoding and with
either multiple Content-Length header fields having differing
field-values or a single Content-Length header field having an
invalid value, then the message framing is invalid and the
recipient MUST treat it as an unrecoverable error. If this is a
request message, the server MUST respond with a 400 (Bad Request)
status code and then close the connection.

uhttpd does not enforce this rule. Instead, when it receives a request with multiple conflicting Content-Length headers, it prioritizes the last. This behavior doesn't pair nicely with gateway servers that prioritize the first receives Content-Length header, but forward them all as-is.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant