Why does IIS not support chunked transfer encoding?

Question

I am making an HTTP connection to an IIS web server and sending a POST request with the data encoded using Transfer-Encoding: chunked. When I do this, IIS simply closes the connection, with no error message or status code. According to the HTTP 1.1 spec,

All HTTP/1.1 applications MUST be able to receive and decode the "chunked" transfer-coding

so I don't understand why it's (a) not handling that encoding and (b) it's not sending back a status code. If I change the request to send the Content-Length rather than Transfer-Encoding, the query succeeds, but that's not always possible.

When I try the same thing against Apache, I get a "411 Length required" status and a message saying "chunked Transfer-Encoding forbidden".

Why do these servers not support this encoding?

Answer 1

My understanding is that chunked encoding can only be used in a HTTP response. A chunked request body would have the property of being incompatible with a 1.0 server, and in any case, there would be no way of a user-agent knowing that the server was a 1.0 server until it had already sent the request.

But I agree it's unclear from the documentation.

Answer 2

My only guess is they did not implement it out of concerns for security. In a naive solution it would be easy to set up a DOS attack by starting multiple chunked transfers that never end. And a complex solution which could account for the DOS attack is probably not worth the effort.

Of course I cannot speak for Apache or IIS, you may be able to contact the Apache team directly though: http://httpd.apache.org/bug_report.html

I agree with MarkR that I always thought chunked encoding could only be used as a response, but the documentation sure makes it sound like it can be used in a request or a response.

Answer 3

Take a look at your client.

Both IIS & Apache support POST requests using chunked transfer-encoding. You can verify this using the curl utility:

curl <upload-url> --form "upfile=@<local_file>" --header "Transfer-Encoding: chunked"

Verify the transfer is chunked using Wireshark

Answer 4

There is no extra DOS angle here. This is still just a single http request with its content formatted differently. The standard doesn't require any especially long timeouts while waiting for the rest of the request.