checkFraming

Checks the headers that frame the body. It rejects what request smuggling relies on: a Content-Length that is not one plain number (duplicate headers are joined with a comma by the Fetch API, so they fail here), Content-Length together with Transfer-Encoding, and any transfer coding other than a single chunked. A declared length over the limit gives 413 before a byte is read.

Import#

import { checkFraming } from "@shadow-js/dusk/server";

Signature#

function checkFraming(headers: Headers, maxBodyBytes: number): FramingProblem | undefined

Parameters#

Returns#

The problem, or undefined when the framing is acceptable.

Examples#

checkFraming(request.headers, 1_048_576);