search

httpwg / http-core

Core HTTP Specifications
https://httpwg.org/http-core/
467 stars 43 forks source link

http 1.1 message body (section 6) and get/head/delete semantics #1102

Open daniel-white opened 1 year ago

daniel-white commented 1 year ago

I think theres a bit of an open loop hole in section 6 of http 1.1. #906 added the SHOULD NOT language to discourage the use of request bodies for get/head/delete methods. Section 6 states:

The presence of a message body in a request is signaled by a Content-Length or Transfer-Encoding header field.

Should the warnings be replicated or linked to here to reduce any confusion?

royfielding commented 1 year ago

The warnings are not repeated here because the signal might occur anyway, and is dealt with accordingly. Messages need to be parsed based on these rules, so if the message indicates it has a body then it will be parsed as containing a body, even if that doesn't match the method semantics (which are enforced elsewhere).