Skip to content

Conversation

@clue
Copy link
Member

@clueclue commented Apr 9, 2018

A request message that contains both a Content-Length and Transfer-Encoding header should not happen in practice. As per https://tools.ietf.org/html/rfc7230#section-3.3.3 this ought to be handled as an error.

If a message is received with both a Transfer-Encoding and a
Content-Length header field, the Transfer-Encoding overrides the
Content-Length. Such a message might indicate an attempt to
perform request smuggling (Section 9.5) or response splitting
(Section 9.4) and ought to be handled as an error."

Refs #137
Build on top of #316

jsor
jsor approved these changes Apr 9, 2018
@WyriHaximusWyriHaximus merged commit cabdec6 into reactphp:masterApr 9, 2018
@clueclue deleted the smuggle branch April 9, 2018 12:24
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@clue@jsor@WyriHaximus