membphis commented on PR #13691: URL: https://github.com/apache/apisix/pull/13691#issuecomment-4954522495
[P2] Conflicting duplicate Content-Type values can bypass consistent body representation validation When `Content-Type` appears more than once, `ngx.req.get_headers()` returns a table. This change falls through to JSON validation, while the original duplicate headers are still forwarded upstream. Different upstreams may select the first value, the last value, or reject the request, so APISIX can validate one representation while the upstream parses another. Please reject conflicting duplicate `Content-Type` values (or only accept duplicates after confirming all normalized values are identical), and add tests for both header orders. RFC 9110 Section 8.3 explicitly warns that repeated `Content-Type` values can create interoperability and security issues when recipients handle them differently. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
