This looks to be a regression introduced in #44144. The IsChunked method in uses LastIndexOf(',') and checks only the substring after the last comma, and for "chunked," the substring after the final comma is empty, and Content-Length is not stripped, but at the kernel-level http.sys driver parses the Transfer-Encoding header correctly and recognizes the "chunked" before the trailing comma. The managed layer thinks the body length is determined by Content-Length while the kernel layer uses chunked encoding.
Kestrel does not appear to be affected by this.
Possible fix (in Request.cs and IISHttpContext.cs):
private static bool IsChunked(string? transferEncoding)
{
if (transferEncoding is null)
{
return false;
}
// Find the last non-empty token separated by commas.
// Per RFC 7230, "chunked" must be the final transfer coding.
var remaining = transferEncoding.AsSpan();
while (remaining.Length > 0)
{
var index = remaining.LastIndexOf(',');
var token = (index >= 0 ? remaining.Slice(index + 1) : remaining).Trim();
if (token.Length > 0)
{
return token.Equals("chunked", StringComparison.OrdinalIgnoreCase);
}
// Empty segment after trailing comma — skip it and look at the previous token.
remaining = index >= 0 ? remaining.Slice(0, index) : default;
}
return false;
}
This looks to be a regression introduced in #44144. The
IsChunkedmethod in usesLastIndexOf(',')and checks only the substring after the last comma, and for "chunked," the substring after the final comma is empty, andContent-Lengthis not stripped, but at the kernel-level http.sys driver parses theTransfer-Encodingheader correctly and recognizes the "chunked" before the trailing comma. The managed layer thinks the body length is determined byContent-Lengthwhile the kernel layer uses chunked encoding.Kestrel does not appear to be affected by this.
Possible fix (in
Request.csandIISHttpContext.cs):