|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #51191 Request body is 0-size when chunked requests are used
Submitted: 2010-03-03 05:55 UTC Modified: 2021-11-27 19:44 UTC
Avg. Score:4.7 ± 0.5
Reproduced:9 of 9 (100.0%)
Same Version:2 (22.2%)
Same OS:4 (44.4%)
From: evert at rooftopsolutions dot nl Assigned:
Status: Open Package: CGI/CLI related
PHP Version: 5.3.1 OS: *
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: evert at rooftopsolutions dot nl
New email:
PHP Version: OS:


 [2010-03-03 05:55 UTC] evert at rooftopsolutions dot nl
Disclaimer: I'm not 100% sure if this is a PHP-FCGI bug.

When (PUT-) HTTP requests are made and encoded as Transfer-Encoding: Chunked, PHP never receives the request body, e.g.:

echo strlen(fopen('php://input','r')); will yield 0.

Chunked Transfer Encoding is used by the OS/X Finder WebDAV client. It works correctly when mod_php is used, but fails with FastCGI.

Nginx and Lighttpd don't support this at all, and return 411 Length Required, which still sucks, but is better than silently failing.

Test script:
echo strlen(fopen('php://input','r'));

Expected result:
size of the request body

Actual result:


Add a Patch

Pull Requests

Pull requests:

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2010-03-03 10:18 UTC]
-Operating System: Any +Operating System: *
 [2010-08-04 08:05 UTC] jpa at php dot mail dot kapsi dot fi
Here is a test case for the bug, using netcat to send the request:

A simple bash cgi script correctly receives the request, so the problem is with PHP's CGI and FCGI interfaces. Instead of requiring a CONTENT_LENGTH header, PHP should simply read to EOF on stdin when TRANSFER_ENCODING is chunked.
 [2010-08-04 09:14 UTC] evert at rooftopsolutions dot nl
I can confirm this is only happening for CGI and FastCGI.

Nginx and Lighttpd don't seem to support this feature at all, and simply return 411 Length Required, but with Apache the request goes through but PHP ends up with an empty request body.
 [2010-11-24 10:34 UTC]
-Package: Apache2 related +Package: CGI related
 [2021-09-15 07:11 UTC] tim dot siebels at iserv dot eu
We are encountering this issue when disabling fastcgi_request_buffering in nginx.
Apparently, others are too [0,1]. The older bug [1] led to apache "fixing" this issue by buffering all chunked requests.

I've opened a thread on the nginx mailinglist [2] regarding this. The assessment there is, that fastcgi is a inherently chunked protocol and thus php should not depend on the CONTENT_LENGTH variable, and rather read out all the fastcgi records to get the body.

How do you feel about this? Do you agree that this should be fixed in php?

 [2021-09-23 11:01 UTC] tim dot siebels at iserv dot eu
The following pull request has been associated:

Patch Name: Fixed reading in streamed body using fastcgi
On GitHub:
 [2021-09-23 11:40 UTC]
See <>.  However,
the FastCGI specs are less clear on that, and I tend to agree that
it makes sense to support chunked requests.
 [2021-11-27 19:44 UTC]
I think FastCGI spec is quite clear about using CGI/1.1 in responder - see . It means that CONTENT_LENGTH is required by spec because it is required by CGI/1.1. Thus I don't think this is a bug and to change that, we would need to change a spec.
 [2021-11-30 08:02 UTC] tim dot siebels at iserv dot eu
Thanks! As a result, I raised these concerns here:
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Apr 13 03:01:29 2024 UTC