Overview

Content-Length states the size of the message body as a decimal number of bytes. The receiver uses it to know exactly how far to read the body — that is, the message boundary.

Details

The value must be the byte count of the body actually transmitted (after any compression/encoding), not a character count (multibyte characters take several bytes). Servers use it for progress indicators, connection reuse, and buffer allocation. A value that disagrees with the real body length causes dropped connections or truncated responses.

When the body size isn't known in advance and must be streamed, use `Transfer-Encoding: chunked` instead of Content-Length. Sending both is forbidden; in HTTP/1.1, when both appear, servers and proxies may interpret them differently — the classic cause of request smuggling.

A server may return 411 Length Required to reject a request body lacking Content-Length, or 413 Content Too Large (Payload Too Large) when the body exceeds an allowed limit.

Syntax

Content-Length: <decimal-byte-count>

e.g. Content-Length: 348

Notes

• Never send Content-Length and Transfer-Encoding together — this is the crux of smuggling vulnerabilities.
• The value is a byte count, not a string length; Korean characters take 3 bytes each in UTF-8.
• A HEAD response has no body but may report, via Content-Length, the size the body would have had for GET.
• Reporting a value smaller/larger than reality causes connection malfunction or response truncation.

Related headers

Related status codes

Specification