diff options
| author | Maxim Dounin <mdounin@mdounin.ru> | 2021-06-28 18:01:06 +0300 |
|---|---|---|
| committer | Maxim Dounin <mdounin@mdounin.ru> | 2021-06-28 18:01:06 +0300 |
| commit | a6c109fea5c13b8aa13ed95ca00a64d62601042b (patch) | |
| tree | bd21103b535e3375e2e91aa789d1dd8aa0d13f4e /src/http/ngx_http_parse.c | |
| parent | 5f85bb3714a81d158f4d849ad5c61aec2737a9f0 (diff) | |
| download | nginx-a6c109fea5c13b8aa13ed95ca00a64d62601042b.tar.gz nginx-a6c109fea5c13b8aa13ed95ca00a64d62601042b.zip | |
Disabled requests with both Content-Length and Transfer-Encoding.
HTTP clients are not allowed to generate such requests since Transfer-Encoding
introduction in RFC 2068, and they are not expected to appear in practice
except in attempts to perform a request smuggling attack. While handling of
such requests is strictly defined, the most secure approach seems to reject
them.
Diffstat (limited to 'src/http/ngx_http_parse.c')
0 files changed, 0 insertions, 0 deletions