I was trying this, on a website where I was allowed to carry out testing by the site administrator. On failing to use two different headers (Site is beyond AWS and I am getting a 400), I tried the old way of using 2 different Content-Length headers.
Finally, I stick with one Content-Length header I added 1 to the length and added a character to the request body. Surprisingly this is getting processed for 2+ mins on all requests on this site and I am not sure what is happening.
To be technical, the ideal request is
POST /endpoint HTTP/1.1
Host: redacted
User-Agent: redacted
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 4
test
And if I modify it to
POST /endpoint HTTP/1.1
Host: redacted
User-Agent: redacted
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 5
5
test
it is processing for long time. I thought it might be a parsing bug, but it is happening for all requests on this site. Is this an issue?
5
is not the beginning of the HTTP body but is an malformed part of the HTTP header - the header ends only after it. Therefore it will either reject the request as malformed or will try to read 5 bytes - but you send only 4 (test
) and thus it will wait for more. Not actually a security question though, but more a missing understanding of HTTP.