geemus/excon — pull request #113 by shaiguitar (2012-02-29 05:07:37+00:00)
Title: Content-Length for GET requests with an empty body

...is zero. Even though the HTTP spec doesn't forbid sending a body in a
GET request, it's generally not recommended to send a body via GET. Some
servers behave oddly with a Content-Length of 0 on a GET request since
it seems there are related security vulnerabilities (IIS, I believe)?

The problem I have is basically that Terremark is denying requests because they have a Content-Length: 0 header being passed in GET requests with no body.

This is what they said:

---- 8< ----
We do not expect any content when the client is making a “GET”. Content-length in a GET method is not explicitly prohibited. But message-body (a property which Content-length is based upon) is prohibited in GET requests. So, I would say, do not include Content-Length header for “GET” requests.
---- 8< ----

http://fixunix.com/tcp-ip/66198-http-rfc-related-question-content-length-0-get-request.html

I can provide more detail on how it fails if you need it, but basically I just want to start a discussion here.

Can we just kill the Content-Length:0 for GET requests? It gets set automatically in Excon, and bottom line is I need a way to ensure it doesn't get set.