Class HttpServerCodec.HttpServerRequestDecoder

    • Constructor Detail

    • Method Detail

      • handleTransferEncodingChunkedWithContentLength

        protected void handleTransferEncodingChunkedWithContentLength​(HttpMessage message)
        Description copied from class: HttpObjectDecoder
        Invoked when a message with both a "Transfer-Encoding: chunked" and a "Content-Length" header field is detected. The default behavior is to throw a ContentLengthNotAllowedException exception, but this method could be overridden to change the behavior (to, e.g., remove the Content-Length header value.

        See: RFC 9112, Section 6.1-15.

             A server MAY reject a request that contains both Content-Length and Transfer-Encoding
             or process such a request in accordance with the Transfer-Encoding alone.
             Regardless, the server MUST close the connection after responding to such a request
             to avoid the potential attacks.
         
        Since Netty itself cannot track the request/response pairing, it cannot guarantee that the connection is closed immediately after the response is sent. As such, it is safer to immediately reject the request.

        Note: RFC 7230 (the previous HTTP/1.1 RFC) allowed the Content-Length header to simply be ignored, in the presence of a Transfer-Encoding header, but this practice is now obsolete and considered unsafe. The RFC 7230 behavior can be restored in the following ways:

        Overrides:
        handleTransferEncodingChunkedWithContentLength in class HttpObjectDecoder