]> git.kaiwu.me - haproxy.git/commit
MINOR: http/hardening: implement hardening "reject-content-length-with-te"
authorWilly Tarreau <w@1wt.eu>
Wed, 4 Nov 2026 15:00:35 +0000 (16:00 +0100)
committerWilly Tarreau <w@1wt.eu>
Wed, 4 Nov 2026 21:45:33 +0000 (22:45 +0100)
commit3bd127283f9f302bf63d9e8723da62a97b269734
treec4b908cc866fa0567f6942ab93a5ef9987c2b2b8
parentddf14a89afad6c767d716b81b6f7f940d866dc35
MINOR: http/hardening: implement hardening "reject-content-length-with-te"

Rejects requests and responses having both a Content-Length header
field and a Transfer-Encoding header field. While these are permitted
by HTTP/1.1 (Transfer-Encoding wins), it can cause problems when the
message first passed through an HTTP/1.0 gateway that does not
recognize Transfer-Encoding, and can desynchronize this gateway from
the rest of the communication. These are still seldom seen in legacy
client or server applications, sometimes in relation with compression
and/or caching. While HAProxy properly normalizes them, it is generally
safe to reject them on public facing listeners.
doc/configuration.txt
include/haproxy/http-t.h
src/h1.c
src/http.c