Cloudflare randomly stripping content-length header on POST if body=<empty>

What is the name of the domain?

assets.procurepm.com

What is the error number?

411

What is the error message?

HTTP Error 411. The request must be chunked or have a content length.

What is the issue you’re encountering

we get random errors to our server b/c cloudflare is stripping content length headers

What steps have you taken to resolve the issue?

We have changed most of our empty posts to CHUNKED TRANSFER encoding to get around this, but it does not work for external libraries (e.g. signalR) where we have no control over the requests.

What are the steps to reproduce the issue?

I made a page Chunked Request Test which posts to two URLs which both point at our server - one proxied/the other unproxied.

It makes 10 requests at a time, either with CHUNKED TRANSFER encoding or normal. The CHUNKED always succeed to both proxied and unproxied (b/c content-length header is not required for CHUNKED), but the normal requests fail 5-10% of the time with a 411 error (you can see it in the console if it doesn’t render cleanly in the textbox).

You will clearly see in the NETWORK tab of the DEVELOPER TOOLS that we ARE sending a content-length header when we randomly get a 411 (missing content-length) from the server. This started the first week in January (presumably when Cloudflare started pushing out their changes)

8 Likes

This issue also affects many of our services exposed through the Cloudflare proxy.

After spending a considerable amount of time investigating the matter, we have reached the same conclusion as James: Cloudflare, in a low but not insignificant percentage of cases, removes the “Content-Length” header.

Like James, we have modified everything we could to work around the issue, but in the case of third-party services, there is nothing we can do.

Obviously, this causes disruptions for us and our customers.

A solution as soon as possible would be greatly appreciated.

6 Likes

I’m glad to see I’m not the only one running into this issue. In the meantime, I updated my reverse proxy (nginx) to add to the proxied request headers content-length 0 if missing.

1 Like

We also have the same issue, we’re getting 411 randomly for empty POST requests. It was working for a years, but now it affects a lot of our APIs.

1 Like

+1 occurring on our side suddenly within the last few weeks. We’ve made no changes internally, and have had no problems until recently so this has to be a Cloudflare change went wrong.

Also had same issue on Windows Server, it’s odd because it happen after MS change.
Just to confirm, is it also happen on Linux?

1 Like

Have you tried rolling back the change to see if the issue stops? I’m just curious on narrowing down the scope, but I am still thinking this is a Cloudflare issue.

Hey,

Does anyone have a repro url/curl that I can use to see where the issue is?
(note by repro I don’t mean hits it 100% of the time, just can hit the issue)

1 Like

@james67 had a nice page to reproduce it but it’s not working actually
you can try this one InariHub

refresh the page some times until it remains completely grey
you will found the error in the console

2 Likes

I provided a URL for testing above, here it is again: Chunked Request Test

No one can provide a curl example where it happens 100% of the time because it does not happen 100% of the time. Neither can anyone roll anything back on their servers because the issue is within Cloudflare.

The issue is, presumably, based on a configuration which is present on only SOME of Cloudflare’s proxy servers. When you make a request to your site, it comes into Cloudflare and is load-balanced across the servers in their datacenters.

Some of those servers are configured to strip out the “Content-Length” header if the request has no body, others do not do so – as such, from the user’s perspective (who has no control of knowledge of which of Cloudflare’s servers process the request) the outcome is random.

Yep hence me saying this: :stuck_out_tongue:

Thanks, looking into it.

If you try testing on the page I linked to (Chunked Request Test) you will reproduce the problem in 5 seconds.All you need to do is click on the Normal Request to the non-proxied URL (where you will get the expected 404 100% of the time), and then click on the Normal Request once or twice to the proxied URL (where you will get a 411 error 5-10% of the time)

Hey,

Thanks for the reports, this is indeed a problem our side with a platform update we’re rolling out. I have reported it to the team.

2 Likes

Hey folks,

This should now be fixed. Thanks for reporting.

3 Likes

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.