TestServer: Content-Length header not added for Posts

[johnthcall]

If you believe you have an issue that affects the security of the platform please do NOT create an issue and instead email your issue details to secure@microsoft.com. Your report may be eligible for our bug bounty but ONLY if it is reported through email.

Describe the bug

When using TestServer for Kestrel based app I saw that the Content-Length header was not populated but that httpContext.Request.Body.Length was. This caused code to be written using the later which throws in production code as kestrels HttpRequestStream throws NotSupportedException on Length.

To Reproduce

Create a TestServer and make a post request where the content of the HttpRequestMessage is ObjectContent. On the receiving side check for the Content-Length header.

It appears that in src/Hosting/TestHost/src/ClientHandler.cs it should be easy to add the Content-Length as the body is being read.

var content = new ObjectContent<T>(resource,
                new JsonMediaTypeFormatter { SerializerSettings = _serializerSettings });
            var request = new HttpRequestMessage(HttpMethod.Post, CreateUri(resourceUri)) { Content = content };
            var response = await _client.SendAsync(request);

Further technical details

• ASP.NET Core version: 2.2.0

VisualStudio 2019 version 16.3.7

dotnet --info
.NET Core SDK (reflecting any global.json):
Version: 3.0.100
Commit: 04339c3a26

Runtime Environment:
OS Name: Windows
OS Version: 10.0.18362
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\3.0.100\

Host (useful for support):
Version: 3.0.0
Commit: 7d57652f33

.NET Core SDKs installed:
2.1.508 [C:\Program Files\dotnet\sdk]
2.1.801 [C:\Program Files\dotnet\sdk]
2.2.109 [C:\Program Files\dotnet\sdk]
2.2.206 [C:\Program Files\dotnet\sdk]
3.0.100 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
Microsoft.AspNetCore.All 2.1.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.1.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.2.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.1.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.1.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.2.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.0.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 2.1.12 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.13 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.2.7 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 3.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.0.0 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

[Tratcher]

It's up to the ObjectContent object and the calling code to set the headers it wants to send to the server. TestServer only forwards what is created by the client. TestServer avoids modifying the request so that the calling code has complete control over what the server application sees (e.g. so you can test with and without the Content-Length header).

If we change anything here it will be to hide httpContext.Request.Body.Length. #15591 in 3.1 may have already changed this indirectly.

On a related note, application code needs to be able to handle requests sent with no length (chunking or h2), specifying the length in advance is completely optional in HTTP.

[analogrelay]

In 3.1 TestServer should now throw if you try to request the Length property, to match the Kestrel behavior, as of #15591.

Closing as we don't intend to take further action here. The Length property of the request body stream is not intended to be supported (since in many cases it's not known). Read the Content-Length header directly if you need it.