Skip to content

Return 500 for invalid transfer encoding on non-body responses - #68901

Open
zeohhh wants to merge 2 commits into
dotnet:mainfrom
zeohhh:fix-kestrel-invalid-transfer-encoding-4382
Open

Return 500 for invalid transfer encoding on non-body responses#68901
zeohhh wants to merge 2 commits into
dotnet:mainfrom
zeohhh:fix-kestrel-invalid-transfer-encoding-4382

Conversation

@zeohhh

@zeohhh zeohhh commented Aug 29, 2026

Copy link
Copy Markdown
  • You've read the Contributor Guide and Code of Conduct.
  • You've included unit or integration tests for your change, where applicable.
  • You've included inline docs for your change, where applicable.
  • There's an open issue for the PR that you are making.

Return a 500 response instead of terminating the connection when an
application completes with an invalid Transfer-Encoding header on a
non-body response.

Description

HttpProtocol.ProduceStart marked the response as HeadersCommitted
before calling CreateResponseHeaders.

When header validation detected an invalid Transfer-Encoding after the
application had completed, Kestrel attempted to replace the response with
a 500 response. This failed because the response was already considered
started, causing the connection to terminate without sending a response.

This change moves the transition to HeadersCommitted until after response
header creation and validation succeeds, while keeping it before
Output.WriteResponseHeaders.

A functional regression test covers GET responses with status codes 204,
205, and 304, as well as HEAD responses. Existing explicit response-start
behavior remains unchanged.

Testing

  • Passed all tests under src/Servers/Kestrel/test.
  • Verified all four regression test cases pass.

Fixes #4382

@zeohhh

zeohhh commented Aug 29, 2026

Copy link
Copy Markdown
Author

@dotnet-policy-service agree

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Setting an invalid Transfer-Encoding response header sometimes kills the connection instead of responding with a 500 status

1 participant