search

openwrt / uhttpd

[MIRROR] Tiny HTTP server
https://git.openwrt.org/?p=project/uhttpd.git;
10 stars 6 forks source link

uhttpd accepts requests with multiple `Content-Length` headers, prioritizing the last #8

Open kenballus opened 4 months ago

kenballus commented 4 months ago

From RFC 7230:

If a message is received without Transfer-Encoding and with either multiple Content-Length header fields having differing field-values or a single Content-Length header field having an invalid value, then the message framing is invalid and the recipient MUST treat it as an unrecoverable error. If this is a request message, the server MUST respond with a 400 (Bad Request) status code and then close the connection.

uhttpd does not enforce this rule. Instead, when it receives a request with multiple conflicting Content-Length headers, it prioritizes the last. This behavior doesn't pair nicely with gateway servers that prioritize the first receives Content-Length header, but forward them all as-is.