question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

RFC: `Content-Length` on Response should be taken into account?

See original GitHub issue

node-fetch currently completely ignoring Content-Length header while consuming response. Fetch specification about handling Content-Length on server response says almost nothing: https://fetch.spec.whatwg.org/#concept-http-network-fetch (see https://github.com/whatwg/fetch/issues/67)

On other hand, we have a fetch-node specific extension to limit the size of the response.

My proposal - analyze and throw early when size for response is specified and Content-Length of response is greater than it.

Issue Analytics

  • State:open
  • Created 3 years ago
  • Reactions:1
  • Comments:8 (1 by maintainers)

github_iconTop GitHub Comments

1reaction
jimmywartingcommented, Jun 12, 2020

size was also one of those things that where added way back before AbortController existed and it was not possible to abort a request

0reactions
issuefilercommented, May 29, 2022

I don’t quite agree on this change. Anything that hides what is actually there in actual responses. Even if it’s invalid, too large a body, it should be able to be seen.

Read more comments on GitHub >

github_iconTop Results From Across the Web

HTTP/1.1: HTTP Message
When a Content-Length is given in a message where a message-body is allowed, its field value MUST exactly match the number of OCTETs...
Read more >
RFC 2616 HTTP/1.1 - IETF
It is a generic, stateless, protocol which can be used for many tasks beyond its use for hypertext, such as name servers and...
Read more >
Why "Content-Length: 0" in POST requests? - Stack Overflow
A valid Content-Length is required on all HTTP/1.0 POST requests. An HTTP/1.0 server should respond with a 400 (bad request) message if it...
Read more >
RFC 7230: Hypertext Transfer Protocol (HTTP/1.1)
The result is a protocol that can be used effectively in many different ... Client/Server Messaging HTTP is a stateless request/response protocol that ......
Read more >
HTTP Request Smuggling - Application Security Cheat Sheet
In the past, differences in the handling of such whitespace have led to security vulnerabilities in request routing and response handling. A server...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found