Skip to content

Conversation

@clue
Copy link
Member

@clue clue commented Apr 9, 2018

A request message that contains both a Content-Length and Transfer-Encoding header should not happen in practice. As per https://tools.ietf.org/html/rfc7230#section-3.3.3 this ought to be handled as an error.

If a message is received with both a Transfer-Encoding and a
Content-Length header field, the Transfer-Encoding overrides the
Content-Length. Such a message might indicate an attempt to
perform request smuggling (Section 9.5) or response splitting
(Section 9.4) and ought to be handled as an error."

Refs #137
Build on top of #316

@WyriHaximus WyriHaximus merged commit cabdec6 into reactphp:master Apr 9, 2018
@clue clue deleted the smuggle branch April 9, 2018 12:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants