POST or PUT method need content-length in request header field.
Does another method(GET, PATCH, DELETE, OPTIONS, CONNECT, TRACE, HEADER) also need content-length?
About content-length in Response, specification is described in rfc2616.
The Content-Length entity-header field indicates the size of the entity-body, in decimal number of OCTETs, sent to the recipient or, in the case of the HEAD method, the size of the entity-body that would have been sent had the request been a GET.
Althought, I couldn't find specification about request header..
The HTTP specification has been updated from RFC2616. Refer to the following instead:
RFC7230 - HTTP/1.1: Message Syntax and Routing
RFC7231 - HTTP/1.1: Semantics and Content
RFC7232 - HTTP/1.1: Conditional Requests
RFC7233 - HTTP/1.1: Range Requests
RFC7234 - HTTP/1.1: Caching
RFC7235 - HTTP/1.1: Authentication
Specifically Section 3.3.2 of RFC7230
A Content-Length SHOULD be sent WHEN the request includes a payload body and a Transfer-Encoding header is not set.
So even a POST or PUT only need to send a Content-Length when there is a body to have a length, this just happens normally be the case with a POST and PUT due to the operations.
There is no problem with sending a Content-Length of 0 to indicate no body, but that is implied by not having a Content-Length or Transfer-Encoding.
These are just the specs though, so your mileage may vary with different http implementations.
Related
How to identify whether an http request has body or not. Referred this HTTP response headers valid with no Transfer-Encoding and Content-Length?. The request made from swagger ui has body and no content-type. But when checking the request it does not have either transfer encoding header or content-length header. How to identify whether it has a body or not.
Content-Type is entirely irrelevant for this.
The full (complex) algorithm to determine the message size is described in RFC 7230. See https://greenbytes.de/tech/webdav/rfc7230.html#rfc.section.3.3.3.
The http spec says about the HEAD request:
The HEAD method is identical to GET except that the server MUST NOT
return a message-body in the response. The metainformation contained
in the HTTP headers in response to a HEAD request SHOULD be identical
to the information sent in response to a GET request.
And also:
The Content-Length entity-header field indicates the size of the
entity-body, in decimal number of OCTETs, sent to the recipient or, in
the case of the HEAD method, the size of the entity-body that would
have been sent had the request been a GET.
So if the requested resource is dynamically generated, for the HEAD request, will the resource ALSO be generated? Should there a Content-Length header or Transfer-Encoding: chunked header?
(I feel this is about how to implement the HTTP protocol.)
ADD 1
I don't see the spec mandates whether to send Content-Length header or how to send it for a dynamically generated resource. Such dynamic resource will be sent with chunked transfer encoding and there'll be no Content-Length header if accessed with a GET method. So, if HEAD response should mimic GET response, the Contnet-Length should not be sent either.
a) That's not the HTTP spec. It is the W3C copy of the now obsolete RFC 2616, dated 1999.
b) For the current spec, see https://greenbytes.de/tech/webdav/rfc7231.html#HEAD
To answer your question: if you don't know the payload size without actually generating it, not sending Content-Length in the HEAD response is ok.
What is the correct response for HTTP GET with a Content-Type? Should we respond with an error or should we ignore the Content-Type and process the request?
According to RFC 7231 section 3.1.1.5:
A sender that generates a message containing a payload body SHOULD
generate a Content-Type header field in that message unless the
intended media type of the enclosed representation is unknown to the
sender. If a Content-Type header field is not present, the recipient
MAY either assume a media type of "application/octet-stream"
([RFC2046], Section 4.5.1) or examine the data to determine its type.
So, anything that has a "body", a payload, in the request, should pass in a Content-type.
GET, DELETE, HEAD, OPTIONS most often don't have such a payload. But the might. So depending on the request method to determine if there is a body or not is not a very safe way.
If your server receives a GET, and it has a body, and that body is not application/octet-stream then it should have a Content-Type header. It is safe to send a 406 - Not Accepted back when you receive such a request.
On the other hand, if your server does not handle body on a GET, then it would be safe to send a 406 - Not Accepted back too.
Is the Content-Length header required for a HTTP/1.0 response? The HTTP spec mentions that it is required for the request, but doesn't mention anything about the response:
http://www.w3.org/Protocols/HTTP/1.0/draft-ietf-http-spec.html#Content-Length
A valid Content-Length field value is required on all HTTP/1.0
request messages containing an entity body.
If it is not required for the response, how does the client read the response when it's larger than 1MB?
Section 10.4 of the spec (which you linked to) doesn't say anything about requirements on responses itself, but instead links to section 7.2.2, which specifies that the server can indicate the length of a response containing an entity body by
sending a Content-Length header, or
closing the connection when the entire response has been sent.
Section 7.2 says that responses to HEAD requests, and 1xx, 204 or 304 responses, should not include an entity body, and therefore need not include a Content-Length header; and
All other responses must include an entity body or a Content-Length header field defined with a value of zero (0).
So to answer the question: When no Content-Length is received, the client keeps reading until the server closes the connection.
What HTTP response headers are required to be sent from server to the client?
I working to optimize the HTTP response headers to minimize the HTTP response overhead. I know "overhead" is somewhat exaggerated, but I like a clean output.
I see a lot of websites sending redundant cache headers, etc..
e.g.
It is redundant to specify both Expires and Cache-Control: max-age, or to specify both Last-Modified and ETag.
Source
HTTP/1.1: Header Field Definitions
It depends on what you define as being required: there are no header fields that must be sent with every response no matter what the circumstances are, but there are header fields that you really should send. The only header field that comes close is Date, but even it has circumstances under which it is not required.
In the parlance of RFC 2119, the term MUST means that something is a requirement of the specification and not meeting the requirement would be invalid. There are no header fields defined by RFCs 7230, 7231, 7232, 7233, 7234, or 7235 that MUST be sent by an origin server in all cases.
The following headers, for example, can be omitted (though you probably should send them):
7.1.1.2. Date
An origin server MUST NOT send a Date header field if it does not
have a clock capable of providing a reasonable approximation of the
current instance in Coordinated Universal Time. An origin server MAY
send a Date header field if the response is in the 1xx
(Informational) or 5xx (Server Error) class of status codes. An
origin server MUST send a Date header field in all other cases.
Note the last sentence of the quote. The Date header field MUST be sent if the origin server is capable of providing a "reasonable approximation" of the date in UTC, but there is nothing stopping a server from misrepresenting itself.
7.4.2. Server
An origin server MAY generate a Server field in its responses.
3.3.2. Content-Length
Aside from [a finite number of predefined cases], in the absence of
Transfer-Encoding, an origin server SHOULD send a Content-Length
header field when the payload body size is known prior to sending the
complete header section.
On the subject of Content-Length and Transfer-Encoding, note that neither can be sent, in which case the length of the response is "determined by the number of octets received prior to the server closing the connection."
3.1.1.5. Content-Type
If a Content-Type header field is not present, the recipient
MAY either assume a media type of application/octet-stream
(RFC2046, Section 4.5.1) or examine the data to determine its type.
There are circumstances under which particular headers can be required, for example:
An origin server that does not support persistent connections MUST send the Connection: close in every response that does not have a 1xx status code.
An origin server MUST generate an Allow header in a 405 (Method Not Allowed) response.
An origin server generating a 401 (Unauthorized) response MUST send a WWW-Authenticate header field containing at least one challenge.
It depends on the specifics of the response, but generally, a response from an origin server should have:
Date
Content-Type
Server
and either Content-Length, Transfer-Encoding or Connection: close.
If you want to do caching, add Cache-Control (e.g., with max-age); Expires isn't generally necessary any more. If you want clients to be able to validate, add Last-Modified or ETag.