Skip to content

fix(method-override): discard stale form content length - #5521

Open
imharjot wants to merge 1 commit into
honojs:mainfrom
imharjot:fix/method-override-content-length
Open

imharjot wants to merge 1 commit into
honojs:mainfrom
imharjot:fix/method-override-content-length

Conversation

@imharjot

@imharjot imharjot commented Oct 4, 2026

Copy link
Copy Markdown

Removing the override field from a URLencoded form changes its body length, but the rewritten request keeps the incoming Content-Length. For _method=DELETE&message=Hello, the body shrinks from 28 to 13 bytes. Forwarding it through Node's fetch then fails with UND_ERR_REQ_CONTENT_LENGTH_MISMATCH.

Drop the stale header when rebuilding the form request, matching the existing multipart branch. Keep the content type and other headers. Requests without a method override retain their original length.

Fixes #5520

Validation:

  • New regressions fail on unchanged code for both default and custom form fields; the unchanged-request control passes. All 15 method-override tests pass with the fix.
  • A real local HTTP forwarding reproduction fails before the fix and returns 200 with the correct body and length afterward.
  • pnpm run test: 5,199 passed, 44 skipped, including TypeScript checks. NO_COLOR was unset for the color tests.
  • pnpm run test:node: 14 passed. pnpm run test:bun: 16 passed.
  • pnpm run build, pnpm run check:fix, and pnpm run editorconfig-checker: passed.

The author should do the following, if applicable

  • Add tests
  • Run tests
  • pnpm run check:fix to format and lint the code
  • Add TSDoc/JSDoc to document code (no API change)

@umeraamir69 umeraamir69 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The urlencoded rewrite path was the gap. Multipart already deletes content-length (and content-type for the new boundary) before rebuilding the Request. Dropping content-length here after stripping the override field matches that, and the test that expects contentLength null after removing _method or a custom form name is the right check.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

methodOverride retains stale Content-Length after rewriting a form body

2 participants