That's not necessarily better as it's sensitive to slowloris attacks, and the handler might not work with streams either, or could just read it all in memory an

That's not necessarily better as it's sensitive to slowloris attacks, and the handler might not work with streams either, or could just read it all in memory anyway, so you're just moving the problem around. Hell, a streaming consumer which doesn't require and check the content-length might even spin forever on CPU if a malicious client keeps sending data.