RFC: `Content-Length` on Response should be taken into account?
See original GitHub issuenode-fetch
currently completely ignoring Content-Length
header while consuming response.
Fetch specification about handling Content-Length
on server response says almost nothing:
https://fetch.spec.whatwg.org/#concept-http-network-fetch
(see https://github.com/whatwg/fetch/issues/67)
On other hand, we have a fetch-node
specific extension to limit the size of the response.
My proposal - analyze and throw early when size
for response is specified and Content-Length
of response is greater than it.
Issue Analytics
- State:
- Created 3 years ago
- Reactions:1
- Comments:8 (1 by maintainers)
Top Results From Across the Web
HTTP/1.1: HTTP Message
When a Content-Length is given in a message where a message-body is allowed, its field value MUST exactly match the number of OCTETs...
Read more >RFC 2616 HTTP/1.1 - IETF
It is a generic, stateless, protocol which can be used for many tasks beyond its use for hypertext, such as name servers and...
Read more >Why "Content-Length: 0" in POST requests? - Stack Overflow
A valid Content-Length is required on all HTTP/1.0 POST requests. An HTTP/1.0 server should respond with a 400 (bad request) message if it...
Read more >RFC 7230: Hypertext Transfer Protocol (HTTP/1.1)
The result is a protocol that can be used effectively in many different ... Client/Server Messaging HTTP is a stateless request/response protocol that ......
Read more >HTTP Request Smuggling - Application Security Cheat Sheet
In the past, differences in the handling of such whitespace have led to security vulnerabilities in request routing and response handling. A server...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
size was also one of those things that where added way back before AbortController existed and it was not possible to abort a request
I don’t quite agree on this change. Anything that hides what is actually there in actual responses. Even if it’s invalid, too large a body, it should be able to be seen.