Question

Based on the HTTP Request Method and Headers, a HTTP server has to determine whether or not to expect a Message Body after the closing CRLFCRLF of the HTTP Request Headers, and also when it does expect one, how many bytes long it is.

How is this calculation made? By what function of the request method and headers can we calculate the length of the request message body.

Followup:

So the HTTP server after parsing the header can simply do the following:

size_t RequestMessageBodyLength()
{
    if (RequestHeaderExists("Content-Length"))
        return RequestHeaderValue("Content-Length");
    else
        return 0;
}

Are there corner cases not covered by the above?

(I expect not, the case of the HEAD request is only for the response, not the request)

Answer 1

There is an entire header for this, called Content-Length, which is specified here and probably explained better here.

Answer to followup:

Yes, a server can use the pseudocode you posted above, as long as it isn’t concerned about security. The general rule about security is: don’t trust input that you didn’t generate. In this case, an attacker could send thousands of requests with header Content-Length: 1000000, and the server would allocate thousands of million-byte buffers and wait around for the content to come in, denying service to legitimate users. A production HTTP server has to account for this possibility, and use timeouts and other means to make sure that this problem doesn’t occur, or is difficult for an attacker to create.