In reply to @omthorat:matrix.org

Hello, while trying to hit a certain url using aiohttp was faced with an invalid http error regarding duplicate content-length headers, I understand the http semantics give a choice between rejecting it as invalid html or merging the duplicates.

The C parser rejected it as invalid error I understand if that's an upstream problem. But even aiohttp's own python parser rejects it the same way.

Just wanted to enquire if this a known choice and if it's something that could be discussed and added to the parser. Didn't make a different issue because I saw a few reporting them same problem before, but I didn't get my answers.

Thank you : )

In reply to @webknjaz:matrix.org
Why do you think having multiple content lengths is useful? Could you quote the RFC where it's allowed?

I don't think it's useful per sey but for my usecase that is vulnerability scanning there are some misbehaving apps that'll use that and I am unable to process my request with aiohttp because the html gets declared invalid.

a recipient of a Content-Length header field value consisting of the same decimal value repeated as a comma-separated list (e.g, "Content-Length: 42, 42") MAY either reject the message as invalid or replace that invalid field value with a single instance of the decimal value, since this likely indicates that a duplicate was generated or combined by an upstream message processor.

src - https://httpwg.org/specs/rfc9110.html#field.content-length
Section 8.6 last paragraph

In reply to @webknjaz:matrix.org
Why do you think having multiple content lengths is useful? Could you quote the RFC where it's allowed?

I don't think it's useful per sey but for my usecase that is vulnerability scanning there are some misbehaving apps that'll use that and I am unable to process my request with aiohttp because the html gets declared invalid. Other tools and frameworks such as curl and requests seem to parse it. I understand that isn't a reason for aiohttp to allow it too, I am asking if it'll possible to do so with the projects current opinions.

a recipient of a Content-Length header field value consisting of the same decimal value repeated as a comma-separated list (e.g, "Content-Length: 42, 42") MAY either reject the message as invalid or replace that invalid field value with a single instance of the decimal value, since this likely indicates that a duplicate was generated or combined by an upstream message processor.

src - https://httpwg.org/specs/rfc9110.html#field.content-length
Section 8.6 last paragraph