Checking whether or not request has a body?

aapo.talvensaari · 2017-12-15T06:09:10+00:00

Hi, This patch is in the openresty/lua-cjson master branch indeed, but not yet shipped in an official OpenResty release. It sho...

Checking whether or not request has a body?

aapo.talvensaari

There are several options:

1. try to read Content-Length header and (ngx.var.content_lenght / ngx.req.get_headers()["Content-Length"] / ngx.var.http_content_length) and assume that if it is zero or less, there is no body.

2. use ngx.req_get_body_data() and check if it is empty string (needs also ngx.req.read_body())

3. use ngx.req.socket() and check if it returns "no body" as error string.

So option 1 is obviously nice, but if there is no such header, we don't really know if there is body (or maybe used faked the header). Option 2 is better as we really do get the body and can check if it is empty, but if all we need to do is to check if there is a body, it feels a bit overkill to allocate strings and such. The option 3 feels like a trick. Relying on "no body" error code seems bit flaky. Also I'm not sure if there are any downsides of it (?).

I would prefer to have something like ngx.req.has_body() if it is possible, is it? What are your takes?

Regards

Aapo

igor.clark

In the absence of ngx.req.has_body(), I'd probably do #1, as I tend to be fairly strict about what endpoints should accept, and unless there's a good reason for not having a Content-Length, I think not having one is an invalid request. If you want to be more flexible about what clients are doing, #2 seems to make sense. I agree #3 seems kind of a hack.

Interestingly though, I tried to make a decision between #1 and #2 based purely on the spec, but it gets kinda complicated because of interaction between Content-Length and Transfer-Encoding. My take would be that "normal" clients don't send chunked-encoding requests, only Content-Encoding headers with an associated Content-Length for compressed payloads - so if a client tries to send a message body to a URL that expects one but doesn't include a Content-Length, I'd drop the request because it seems fishy to me. Which nets out at #1. But I'd be really interested to know if you or others have experience that says otherwise!

On Thu, Dec 14, 2017 at 2:09 PM, Aapo Talvensaari <aapo.ta...@gmail.com> wrote:

There are several options:

1. try to read Content-Length header and (ngx.var.content_lenght / ngx.req.get_headers()["Content-Length"] / ngx.var.http_content_length) and assume that if it is zero or less, there is no body.
2. use ngx.req_get_body_data() and check if it is empty string (needs also ngx.req.read_body())
3. use ngx.req.socket() and check if it returns "no body" as error string.

So option 1 is obviously nice, but if there is no such header, we don't really know if there is body (or maybe used faked the header). Option 2 is better as we really do get the body and can check if it is empty, but if all we need to do is to check if there is a body, it feels a bit overkill to allocate strings and such. The option 3 feels like a trick. Relying on "no body" error code seems bit flaky. Also I'm not sure if there are any downsides of it (?).

I would prefer to have something like ngx.req.has_body() if it is possible, is it? What are your takes?

Regards
Aapo

.

zchao1995

I think option 1 is the best way for checking whether this HTTP request carries request body or not.

When neither Content-Length nor Transfer-Encoding is exists, the remain data in this connection should be treated as the next pipelined request,

and this also conforms the design of ngx_http_read_client_request_body which also checks the request body by Content-Length and Transfer-Encoding.