2 ms·
Solution seems funky. Attackers could just omit the Content-Length header
by flightofthefox 5y ago
Solution seems funky. Attackers could just omit the Content-Length header
- ypeter 5y agoMaybe Cloud Armor calculates en sets it?
- parts 5y agoIf you omit the Content-Length header from an HTTP request, the server will not process the request body. See: https://reqbin.com/Article/ContentLength https://reqbin.com/Article/ContentLength "If the value of the Content-Length header is zero, or if neither the Transfer-Encoding header nor the Content-Length header is specified, then the message has no body. "