Lesson 10.2

Reject, don't repair - the framing decision and the smuggling probe

Rewrite next() to hand off the Request at headers-complete, and write _enterBody, the framing decision that refuses the Content-Length plus Transfer-Encoding ambiguity behind request smuggling.

28 minsrc/parser.js
What you will build
  • Return a Request the moment the header block terminates for a message with a body.
  • Decide body framing from the header map - none, content-length, or chunked.
  • Reject the CL+TE conflict, duplicate or non-chunked TE, and duplicate or non-digit CL as 400s.
Locked

This chapter is part of the framework capstone. Chapters 1 and 2 are free to build - unlock the rest to keep going.

Unlock the depth