5

In broader context, we would like to limit the size of a messages a client can send to the server by http post request.

I would like to do this by using http header content-length. So I don't have to read the full body, just check this header, and reject the request, if content-length is too large, also reject if content-lenght is missing (http 411 error code)

So I want to be sure that the actual size of message body is the same as set in content-length of the request.

The question is if Tomcat or Spring MVC (my stack) does a validate if the content-lenght is actually represents the reals size of the message body?

(This should be quite easy to implement it with a filter, just wondering if a servlet container, or spring dispatcher servlet does not do like this out of the box.)

BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
csviri
  • 1,159
  • 3
  • 16
  • 31
  • I think the filter method would be the way to go - that is a bit of a specialized use case and neither of Tomcat or Spring does this by default. – stdunbar May 18 '16 at 14:52
  • Don't forget that there is [Chunked transfer encoding](https://en.wikipedia.org/wiki/Chunked_transfer_encoding) – Ilya May 18 '16 at 16:33
  • 1
    If it doesn't, it absolutely should. Potential attack vector for DDOS. – christopher May 19 '16 at 07:36
  • Thx @Ilya - chunked requests we will reject automatically here. – csviri May 19 '16 at 07:36
  • @stdunbar - My use case is special, however in general, it could be done to check if the message body is really the size that is in content-lenght, anyway if you put it as an answer I accept it, thx! – csviri May 19 '16 at 07:37
  • @christopher, yes agree, our intention is basically to prevent that, with this. – csviri May 19 '16 at 07:38
  • Found this, what is related, but does not solve the problem: http://stackoverflow.com/questions/14075287/does-maxpostsize-apply-to-multipart-form-data-file-uploads – csviri May 20 '16 at 13:52

1 Answers1

4

Tomcat handles it.

After made some test on a simple web app with cases:

  1. If content-lenght is not present it will read 0 bytes from content.
  2. If we have longer content than provided in content-lenght header, with keep-alive true, then after reading the the body of a size content lenght, it will try to process the remaining body as a new request (and will fail with bad request)
  3. in the same situation as in point 2, just the keep alive is false, we will still just receive body of length as in content-length header.
csviri
  • 1,159
  • 3
  • 16
  • 31