You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If a valid Content-Length header field is present without Transfer-Encoding, its decimal value defines the expected message body length in octets. If the sender closes the connection or the recipient times out before the indicated number of octets are received, the recipient MUST consider the message to be incomplete and close the connection.
Cheroot does not enforce this rule. When it receives a request, and the sender half-closes the connection, Cheroot responds regardless of whether the request's body has been fully received.
To reproduce
Start a Cheroot-based HTTP server that echos the message body. (e.g., something like this)
Send it a request with an incomplete message body, followed by half-closing the socket, and observe that it still responds:
Description of the bug
From RFC 9112:
Cheroot does not enforce this rule. When it receives a request, and the sender half-closes the connection, Cheroot responds regardless of whether the request's body has been fully received.
To reproduce
The text was updated successfully, but these errors were encountered: