Reject requests that don't set Content-Length or Transfer-Encoding: chunked

[cesarblum]

Requests containing a body (POST, PUT, CONNECT, PATCH, OPTIONS) should be rejected with a 411 Length Required if they don't include a Content-Length or Transfer-Encoding: chunked header.

[cesarblum]

I was re-reading the spec and it says this:

The presence of a message body in a request is signaled by a
Content-Length or Transfer-Encoding header field.  Request message
framing is independent of method semantics, even if the method does
not define any use for a message body.

https://tools.ietf.org/html/rfc7230#section-3.3

Which means there's no "hard rule" for what methods can or cannot contain a body. We could be prescriptive here and determine that POST and some other methods must send Transfer-Encoding or Content-Length, but that seems unnecessary.

RFC 7231 actually helps here. For GET, it says

A payload within a GET request message has no defined semantics;
sending a payload body on a GET request might cause some existing
implementations to reject the request.

https://tools.ietf.org/html/rfc7231#section-4.3.1

There are similar statements for HEAD, DELETE and CONNECT. It explicitly forbids a message body in TRACE requests. OPTIONS is the least clear one - the spec mentions Content-Type but nothing about requiring Content-Length: 0 if there's no payload body.

We already somewhat guard against messages that don't specify a content length by assuming 0. This means things could silently fail or behave strangely for some apps. Deciding on a set of methods and sending a 411 is more explicit. But then the spec doesn't help a lot in deciding which methods to treat like that.

[cesarblum]

I'm thinking of making this change for POST and PUT only, leaving OPTIONS out (I'm not familiar with how clients use OPTIONS).

[cesarblum]

This seems to be what IIS does btw. I know lighttpd requires Content-Length on POST too (and I assume PUT). I'll check nginx.

[cesarblum]

Same for nginx.

[muratg]

If we can't get this in soon, let's move it to 1.2.0.