You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Clarification regarding host behaviour with Content-Length header #805
What is the expected/acceptable behavior in the host in terms of automatically setting the Content-Length header on behalf of the guest when the size of the body is known?
Good question, b/c I know this varies widely. The expectation, iiuc, is that the host never sets Content-Length automatically, and thus it's up to the guest (or more likely: the guest's HTTP standard library) to set Content-Length appropriately (e.g., the JS Request constructor would set Content-Length when given a Blob, but not when given a ReadableStream). Supporting this: there's not even really a general way for a WASI host to know the body length up front (given the design of streams and the lack of any sort of length-specified-up-front-stream.
My expectation would be that the host should set Content-Length, since it's part of the HTTP/1.1 message framing; quite analogously, the host is responsible for setting Transfer-Encoding: chunked. Allowing the guest to set Content-Length could allow scary response desync and smuggling. Also, there's no guarantee that the host is even speaking HTTP/1.1, but might be HTTP/2 or HTTP/3 or FastCGI, none of which have any use for Content-Length, so it'd be weird for the guest (which has no knowledge of what protocol the host's speaking on the other side) to have to specify HTTP/1.1-specific details.
Activity
lukewagner commentedon Mar 1, 2024
Good question, b/c I know this varies widely. The expectation, iiuc, is that the host never sets
Content-Lengthautomatically, and thus it's up to the guest (or more likely: the guest's HTTP standard library) to setContent-Lengthappropriately (e.g., the JSRequestconstructor would setContent-Lengthwhen given aBlob, but not when given aReadableStream). Supporting this: there's not even really a general way for a WASI host to know the body length up front (given the design of streams and the lack of any sort of length-specified-up-front-stream.sepointon commentedon May 31, 2026
My expectation would be that the host should set Content-Length, since it's part of the HTTP/1.1 message framing; quite analogously, the host is responsible for setting Transfer-Encoding: chunked. Allowing the guest to set Content-Length could allow scary response desync and smuggling. Also, there's no guarantee that the host is even speaking HTTP/1.1, but might be HTTP/2 or HTTP/3 or FastCGI, none of which have any use for Content-Length, so it'd be weird for the guest (which has no knowledge of what protocol the host's speaking on the other side) to have to specify HTTP/1.1-specific details.