HttpComponentsClientHttpRequestFactory does not set Content-Length: 0

[tholinka]

Affects: 6.1.6

I have an API that requires sending a Content-Length: 0 when the body is null/empty.

When we previously upgraded to Spring Boot 3 / Spring 6, we changed our RestTemplate to use new BufferingClientHttpRequestFactory(new HttpComponentsClientHttpRequestFactory()) as the request factory in order to ensure that a Content-Length was set.

This worked on 6.1.5, but on upgrading to 6.1.6 we are no longer sending the Content-Length header.

---

Stepping through the code with a debugger, this changed in 019ce44 / gh-32612.

spring-framework/spring-web/src/main/java/org/springframework/http/client/BufferingClientHttpRequestWrapper.java

Line 58 in 019ce44

if (bufferedOutput.length > 0) {

I can force the old behavior if I do the following, which leads me to believe it is that commit (effectively, I'm trying to just skip over the new if):

• Set a breakpoint at line 58 and at line 59 of BufferingClientHttpRequestWrapper
• (on line 58 breakpoint) in the evaluation expression window run bufferedOutput = new byte[1];
• Continue to line 59 breakpoint
• (on line 59 breakpoint) in the evaluation expression window run bufferedOutput = new byte[0];

Doing this then causes the Content-Length: 0 header to be sent as expected.

---

I tried also manually setting Content-Length: 0 as a header, but HttpComponentsClientHttpRequest does not allow that, as is explicitly ignores Content-Length as a header.

spring-framework/spring-web/src/main/java/org/springframework/http/client/HttpComponentsClientHttpRequest.java

Line 110 in 019ce44

else if (!HttpHeaders.CONTENT_LENGTH.equalsIgnoreCase(headerName) &&

---

This still works as expected (Content-Length: 0 is set) when using SimpleClientHttpRequestFactory, so for now I can work around this by using new BufferingClientHttpRequestFactory(new SimpleClientHttpRequestFactory()) instead. However, I would prefer to use HttpComponentsClientHttpRequestFactory instead of Simple if possible.

[tholinka]

Looking into it some more, in org.apache.hc.core5.http.protocol.RequestContent.process() there is a null check for if entity is null. With the previous version, this is empty, but with the change in the BufferingClientHttpRequestWrapper it is now null.

This is because of this check:

spring-framework/spring-web/src/main/java/org/springframework/http/client/HttpComponentsClientHttpRequest.java

Line 91 in 019ce44

if (body != null) {

In 6.1.5, this check would be true when using BufferingClientHttpRequestFactory (body would be empty, but not null). However, in 6.1.6 because of 019ce44 it is now null, so the entity is null.

[bclozel]

I have an API that requires sending a Content-Length: 0 when the body is null/empty.

Before investigating more we should question this requirement. The previous behavior was changed because it was considered invalid with regards to the spec. Is there anything supporting this behavior in clients in general?

[tholinka]

Sadly this isn't changeable from my team. We're trying to call an external API that is very resistant to change, and they've always required sending Content-Length as a header.

e.g. this curl works:

$ curl --location --request POST 'https://example.com/endpoint' --header 'Authorization: TOKEN' --header 'Content-Length: 0'
# good response

and so does this one:

$ curl --location --request POST 'https://example.com/endpoint' --header 'Authorization: TOKEN' --data-raw ''
# good response

but this one does not:

$ curl --location --request POST 'https://example.com/endpoint' --header 'Authorization: TOKEN'
# replies with "Content-Length is missing"

So having some way to send Content-Length when it's 0 would be nice. From my understanding of the spec, it's just negative numbers that aren't valid. 0 is a valid Content-Length, I believe.

[tholinka]

We're trying to call in our code with the following currently

HttpEntity<Object> entity = new HttpEntity<>("", headers);
ResponseEntity<Response> response = restTemplate.exchange(url, HttpMethod.POST, entity, Response.class);

I could understand not sending Content-Length: 0 if the body is null, but we're explicitly trying to send an empty body, because we do want the Content-Length header.

Also, for what it's worth, we do get a Content-Length: 0 header as expected if we use new BufferingClientHttpRequestFactory(new SimpleClientHttpRequestFactory()), or if we use new JdkClientHttpRequestFactory().

[poutsma]

This seems related to, or perhaps even in contradiction of, #32650.

[tholinka]

I don't think this is contradicted by #32650, for instance, in #32650 (comment) @nhmarujo lays out almost exactly the same as what I would expect. Thought that is somewhat contradicted by #32650 (comment), so maybe not...

in #32650, the conclusion seems to me (and it seems to me that it works this way with SimpleClientHttpRequestFactory and JdkClientHttpRequestFactory):

• does NOT set header:
  • null
• DOES set header:
  • empty (but not null, e.g. "")
  • explicitly set
  • non-empty (body has an actual value)

Whereas currently with BufferingClientHttpRequestFactory + HttpComponentsClientHttpRequestFactory, this is what currently happens from my testing:

• does NOT set header:
  • null
  • empty (but not null, e.g. "")
  • explicitly set (this value is completely ignored, because httpclient5 throws when Content-Length is set, unless the override config value is set)
• DOES set header:
  • non-empty (body has an actual value)

Hopefully those that worked on #32650 can comment, as maybe I'm misunderstanding something here.