Securely overwrite X-Content-Length for mitigating request smuggling via TransferEncoding & ContentLength headers by DeagleGross · Pull Request #65445 · dotnet/aspnetcore

DeagleGross · 2026-02-16T10:08:06Z

Noticed that we are removing Content-Length header and writing the value to X-Content-Length in case of detecting request smuggling attempt via Transfer-Encoding and Content-Length headers.

However, if user has explicitly passed X-Content-Length, code will throw because we are doing a standard dictionary.Add() of X-Content-Length.

Changed to use TryAdd() to avoid unintended behavior.

Copilot

Pull request overview

This pull request addresses a potential exception in request smuggling mitigation logic across three ASP.NET Core server implementations (Kestrel, IIS, and HttpSys). When both Transfer-Encoding and Content-Length headers are present in a request (a potential request smuggling attack), the servers move the Content-Length value to an X-Content-Length header for diagnostic purposes. The PR changes from using Add() to TryAdd() to prevent exceptions when a client has explicitly sent an X-Content-Length header.

Changes:

Modified header handling logic to use TryAdd() instead of Add() for X-Content-Length across Kestrel, IIS, and HttpSys server implementations
Added tests for Kestrel and HttpSys to verify behavior when all three headers (Transfer-Encoding, Content-Length, and X-Content-Length) are present

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/Servers/Kestrel/Core/src/Internal/Http/Http1MessageBody.cs	Changed to use TryAdd for X-Content-Length to avoid exception, added comment explaining behavior
src/Servers/IIS/IIS/src/Core/IISHttpContext.cs	Changed to use TryAdd for X-Content-Length to avoid exception, added comment explaining behavior
src/Servers/HttpSys/src/RequestProcessing/Request.cs	Changed to use TryAdd for X-Content-Length to avoid exception, added comment explaining behavior
src/Servers/Kestrel/Core/test/Http1/Http1ConnectionTests.cs	Added test verifying X-Content-Length is preserved when explicitly set by user
src/Servers/HttpSys/test/FunctionalTests/RequestHeaderTests.cs	Added test verifying X-Content-Length is preserved when explicitly set by user

Copilot · 2026-02-16T10:11:56Z

+            Assert.Single(requestHeaders["X-Content-Length"]);
+            Assert.Equal("123", requestHeaders["X-Content-Length"]);


Test behavior concern: This test verifies that when a user explicitly provides X-Content-Length, it's preserved instead of being overwritten with the actual Content-Length. However, this behavior might not align with the security purpose of X-Content-Length, which is to preserve the actual Content-Length for diagnostic purposes during request smuggling detection. If the implementation changes to always overwrite X-Content-Length with the server-observed Content-Length (which would be more secure), this test's assertions would need to be updated accordingly.

Suggested change

Assert.Single(requestHeaders["X-Content-Length"]);

Assert.Equal("123", requestHeaders["X-Content-Length"]);

Assert.True(requestHeaders.ContainsKey("X-Content-Length"));

Assert.Single(requestHeaders["X-Content-Length"]);

Copilot · 2026-02-16T10:11:56Z

        IHeaderDictionary headerDictionary = Headers;
-        headerDictionary.Add("X-Content-Length", headerDictionary[HeaderNames.ContentLength]);
+
+        // dont overwrite if user explicitly set X-Content-Length


Grammar issue: "dont" should be "don't". This comment should match the style used in the other implementations (Http1MessageBody.cs and IISHttpContext.cs).

Suggested change

// dont overwrite if user explicitly set X-Content-Length

// Don't overwrite if user explicitly set X-Content-Length

Copilot · 2026-02-16T10:11:56Z

+                // if user already passed X-Content-Length, we won't overwrite it
+                _ = headerDictionary.TryAdd("X-Content-Length", headerDictionary[HeaderNames.ContentLength]);


Security concern: Using TryAdd preserves a user-supplied X-Content-Length header instead of recording the actual Content-Length value that triggered the smuggling detection. This could allow an attacker to hide the true Content-Length value in diagnostics/logs.

Consider using a pattern that always overwrites X-Content-Length with the actual Content-Length value to ensure accurate diagnostics of potential request smuggling attempts. For example:

Remove existing X-Content-Length if present

Add the actual Content-Length to X-Content-Length

Then remove Content-Length

The purpose of X-Content-Length is to preserve the original Content-Length for diagnostic purposes when request smuggling is detected. Preserving an attacker-supplied value defeats this purpose.

Suggested change

// if user already passed X-Content-Length, we won't overwrite it

_ = headerDictionary.TryAdd("X-Content-Length", headerDictionary[HeaderNames.ContentLength]);

headerDictionary.Remove("X-Content-Length");

headerDictionary["X-Content-Length"] = headerDictionary[HeaderNames.ContentLength];

Copilot · 2026-02-16T10:11:57Z

+                // if user already passed X-Content-Length, we won't overwrite it
+                _ = RequestHeaders.TryAdd("X-Content-Length", RequestHeaders[HeaderNames.ContentLength]);


Security concern: Using TryAdd preserves a user-supplied X-Content-Length header instead of recording the actual Content-Length value that triggered the smuggling detection. This could allow an attacker to hide the true Content-Length value in diagnostics/logs.

Consider using a pattern that always overwrites X-Content-Length with the actual Content-Length value to ensure accurate diagnostics of potential request smuggling attempts. For example:

Remove existing X-Content-Length if present

Add the actual Content-Length to X-Content-Length

Then remove Content-Length

The purpose of X-Content-Length is to preserve the original Content-Length for diagnostic purposes when request smuggling is detected. Preserving an attacker-supplied value defeats this purpose.

Suggested change

// if user already passed X-Content-Length, we won't overwrite it

_ = RequestHeaders.TryAdd("X-Content-Length", RequestHeaders[HeaderNames.ContentLength]);

var originalContentLength = RequestHeaders[HeaderNames.ContentLength];

RequestHeaders.Remove("X-Content-Length");

RequestHeaders["X-Content-Length"] = originalContentLength;

Copilot · 2026-02-16T10:11:57Z

+        // dont overwrite if user explicitly set X-Content-Length
+        _ = headerDictionary.TryAdd("X-Content-Length", headerDictionary[HeaderNames.ContentLength]);


Security concern: Using TryAdd preserves a user-supplied X-Content-Length header instead of recording the actual Content-Length value that triggered the smuggling detection. This could allow an attacker to hide the true Content-Length value in diagnostics/logs.

Consider using a pattern that always overwrites X-Content-Length with the actual Content-Length value to ensure accurate diagnostics of potential request smuggling attempts. For example:

Remove existing X-Content-Length if present

Add the actual Content-Length to X-Content-Length

Then remove Content-Length

The purpose of X-Content-Length is to preserve the original Content-Length for diagnostic purposes when request smuggling is detected. Preserving an attacker-supplied value defeats this purpose.

Suggested change

// dont overwrite if user explicitly set X-Content-Length

_ = headerDictionary.TryAdd("X-Content-Length", headerDictionary[HeaderNames.ContentLength]);

// Always record the original Content-Length in X-Content-Length for diagnostics,

// even if the client supplied its own X-Content-Length header.

headerDictionary.Remove("X-Content-Length");

headerDictionary["X-Content-Length"] = headerDictionary[HeaderNames.ContentLength];

Copilot · 2026-02-16T10:11:57Z

+                // if user already passed X-Content-Length, we won't overwrite it
+                _ = RequestHeaders.TryAdd("X-Content-Length", RequestHeaders[HeaderNames.ContentLength]);


Test coverage: The IIS implementation in IISHttpContext.cs was updated with the same logic change (TryAdd for X-Content-Length), but no corresponding test was added for the IIS server. The Kestrel and HttpSys servers both have tests covering the scenario where Transfer-Encoding, Content-Length, and X-Content-Length are all present. Consider adding a similar test for IIS to ensure consistent behavior across all server implementations.

Add test at https://github.com/dotnet/aspnetcore/blob/main/src/Servers/IIS/IIS/test/Common.FunctionalTests/RequestResponseTests.cs#L772

Copilot · 2026-02-16T10:11:57Z

+        Assert.True(_http1Connection.RequestHeaders.ContainsKey("X-Content-Length"));
+        Assert.Equal(userXContentLength, _http1Connection.RequestHeaders["X-Content-Length"]);
+        Assert.True(_http1Connection.RequestHeaders.ContainsKey(HeaderNames.TransferEncoding));
+        Assert.Equal("chunked", _http1Connection.RequestHeaders[HeaderNames.TransferEncoding]);
+        Assert.False(_http1Connection.RequestHeaders.ContainsKey(HeaderNames.ContentLength));
+    }


Test behavior concern: This test verifies that when a user explicitly provides X-Content-Length, it's preserved instead of being overwritten with the actual Content-Length. However, this behavior might not align with the security purpose of X-Content-Length, which is to preserve the actual Content-Length for diagnostic purposes during request smuggling detection. If the implementation changes to always overwrite X-Content-Length with the server-observed Content-Length (which would be more secure), this test's assertions would need to be updated accordingly.

BrennanConroy · 2026-02-17T21:23:08Z

+                // if user already passed X-Content-Length, we won't overwrite it
+                _ = RequestHeaders.TryAdd("X-Content-Length", RequestHeaders[HeaderNames.ContentLength]);


Add test at https://github.com/dotnet/aspnetcore/blob/main/src/Servers/IIS/IIS/test/Common.FunctionalTests/RequestResponseTests.cs#L772

dont throw on having x-content-length

9a8923a

DeagleGross self-assigned this Feb 16, 2026

DeagleGross added the area-networking Includes servers, yarp, json patch, bedrock, websockets, http client factory, and http abstractions label Feb 16, 2026

Copilot AI review requested due to automatic review settings February 16, 2026 10:08

DeagleGross requested review from BrennanConroy, JamesNK and halter73 as code owners February 16, 2026 10:08

Copilot started reviewing on behalf of DeagleGross February 16, 2026 10:08 View session

DeagleGross enabled auto-merge (squash) February 16, 2026 10:10

Copilot AI reviewed Feb 16, 2026

View reviewed changes

BrennanConroy approved these changes Feb 17, 2026

View reviewed changes

DeagleGross merged commit af25746 into dotnet:main Feb 17, 2026
33 checks passed

dotnet-policy-service Bot added this to the 11.0-preview2 milestone Feb 17, 2026

DeagleGross deleted the dmkorolev/x-content-length-validation branch February 18, 2026 10:50

dotnet-maestro Bot mentioned this pull request Feb 25, 2026

[main] Source code updates from dotnet/aspnetcore dotnet/dotnet#5075

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Securely overwrite X-Content-Length for mitigating request smuggling via TransferEncoding & ContentLength headers#65445

Securely overwrite X-Content-Length for mitigating request smuggling via TransferEncoding & ContentLength headers#65445
DeagleGross merged 1 commit into
dotnet:mainfrom
DeagleGross:dmkorolev/x-content-length-validation

DeagleGross commented Feb 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

BrennanConroy Feb 17, 2026

Uh oh!

Copilot AI Feb 16, 2026

Uh oh!

BrennanConroy Feb 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		Assert.Single(requestHeaders["X-Content-Length"]);
		Assert.Equal("123", requestHeaders["X-Content-Length"]);

	// dont overwrite if user explicitly set X-Content-Length
	// Don't overwrite if user explicitly set X-Content-Length

		// if user already passed X-Content-Length, we won't overwrite it
		_ = headerDictionary.TryAdd("X-Content-Length", headerDictionary[HeaderNames.ContentLength]);

		// if user already passed X-Content-Length, we won't overwrite it
		_ = RequestHeaders.TryAdd("X-Content-Length", RequestHeaders[HeaderNames.ContentLength]);

-                // if user already passed X-Content-Length, we won't overwrite it
-                _ = RequestHeaders.TryAdd("X-Content-Length", RequestHeaders[HeaderNames.ContentLength]);
+                var originalContentLength = RequestHeaders[HeaderNames.ContentLength];
+                RequestHeaders.Remove("X-Content-Length");
+                RequestHeaders["X-Content-Length"] = originalContentLength;

-        // dont overwrite if user explicitly set X-Content-Length
-        _ = headerDictionary.TryAdd("X-Content-Length", headerDictionary[HeaderNames.ContentLength]);
+        // Always record the original Content-Length in X-Content-Length for diagnostics,
+        // even if the client supplied its own X-Content-Length header.
+        headerDictionary.Remove("X-Content-Length");
+        headerDictionary["X-Content-Length"] = headerDictionary[HeaderNames.ContentLength];

Conversation

DeagleGross commented Feb 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

BrennanConroy Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

Uh oh!

BrennanConroy Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants