content
Content-Length
Number of octets in the message body, letting the recipient know exactly where the message ends. Required for most requests with bodies unless Transfer-Encoding: chunked is used.
Content-Length: <decimal-octet-count>Common directives / values
| Directive | Purpose |
|---|---|
| 0 | Explicit empty body — common on POST/PUT with no payload. |
| <n> | Exact byte count of the body; must match reality. |
| omitted with chunked | Do NOT send Content-Length together with Transfer-Encoding: chunked. |
Examples
Content-Length: 348Body is exactly 348 bytes.
Content-Length: 0\nContent-Type: application/jsonPOST with no body; Content-Length: 0 is preferred to omission.
HTTP/1.1 204 No Content\nContent-Length: 0204 responses conventionally include Content-Length: 0.
Transfer-Encoding: chunkedAlternative when the length isn't known up front — Content-Length must be absent.
Gotcha
Sending both Content-Length and Transfer-Encoding: chunked is the classic request-smuggling vector (CL.TE / TE.CL); load balancers and origins must agree on parsing. A wrong count silently truncates or hangs the connection.
Related headers
Content-Type
Declares the media type of the body in both requests and responses, and often carries additional parameters like charset or boundary. Governs how the recipient parses or renders the payload.
Content-Encoding
Indicates that the body has been transformed with one or more compressions and must be decoded in reverse order to recover the original payload. Negotiated via the client's Accept-Encoding.
Content-Disposition
In responses, controls whether the browser renders the body inline or offers it as a download, and suggests a filename. In multipart/form-data request parts, names the form field and optionally the upload filename.
Host
Identifies the target host and optional port of the request, so a single IP can serve many virtual hosts. Missing Host in an HTTP/1.1 request MUST yield 400 Bad Request.
Accept-Encoding
Client advertisement of which content codings it can decode, letting the server compress the response accordingly. Absence means 'identity only'; an explicit identity;q=0 forbids uncompressed responses.