Request Content-Length differs from actual request body length

Question

I'm monitoring and checking event logs for security policy for a new virtual server, I found:
&nbsp;
I tried a tool called fiddler to calculate request body length it gave me (Content-Length: 4009), so request body length is 4009 or 65536 ??&nbsp;
what is causing this issue? how to check it?&nbsp;
I have contact with the dev team, they have a workaround to disallow this value in the header from being sent, can I do the same on the BIG-IP via iRule or something, as far I know I can disable HTTP protocol compliance checks for unparsable request content but will disable a lot of sub-violations: https://support.f5.com/csp/article/K44162352&nbsp;

mohanad · Answer

hereunder the request details:&nbsp;
Orginal request &nbsp;
Request actual size: 66526 bytes.&nbsp;
Request was truncated.&nbsp;
POST /CPESSite/Main.aspx?module=CMS HTTP/1.1&nbsp;
Host: x.x.x.x&nbsp;
Connection: keep-alive&nbsp;
Content-Length: 107190&nbsp;
Cache-Control: max-age=0&nbsp;
Origin: &nbsp;
Upgrade-Insecure-Requests: 1&nbsp;
Content-Type: application/x-www-form-urlencoded&nbsp;
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36&nbsp;
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8&nbsp;
Referer: &nbsp;
Accept-Encoding: gzip, deflate, br&nbsp;
Accept-Language: en-US,en;q=0.9&nbsp;
Cookie: ASP.NET_SessionId=pag0eyb1w4wozbub41yevxnt; __AntiXsrfToken=e475b8e564504f8ea3a787d9612025a8; AuthToken=6dfe0ac5-9892-4b27-bb08-53868a027111; TS0129144f=01441a34f8d97de5526f6b4fd247b716f9d01d3faa3aaade07262d37b37a657d25c5a1c4a03fae4d33b561d4c8261f73c1af53275e4aeeb02abb76f8df76f50f91a297bbd9c578fa9451c9bec58035056dc08bcc6119f00869035544c9802c13012716840f&nbsp;
X-Forwarded-For: x.x.x.x&nbsp;
RadScriptManager1_TSM=%3B%3BSystem.Web.Extensions%2C+Version%3D4.0.0.0%2C+Culture%3Dneutral%2C+PublicKeyToken%3D31bf3856ad364e35%3Aen-US%3A5b26ea0c-07c7-4ade-acc6-bb37f156b712%3Aea597d4b%3Ab25378d2%3BTelerik.Web.UI%3Aen-US%3A0e2aaed8-3b29-4dda-bbe2-51b16609be9a%3A16e4e7cd%3Af7645509%3A22a6274a%3Aed16cbdc%3A24ee1bba%3A874f8ea2%3Ac128760b%3A19620875%3Af46195d3%3A92fe8ea0%3Afa31b949%3A490a9d4e%3A11a04f7e%3Ae330518b%3A2003d0b8%3A1e771326%3A88144a7a%3Ac8618e41%3A1a73651d%3A333f8d94%3Ae524c98b%3A6a6d718d%3A4cacbc31%3A2a8622d7&amp;RadStyleSheet1_TSSM=%3BTelerik.Web.UI%2C+Version%3D2014.3.1209.40%2C+Culture%3Dneutral%2C+PublicKeyToken%3D121fae78165ba3d4%3Aen-US%3A0e2aaed8-3b29-4dda-bbe2-51b16609be9a%3A92753c09%3A5c0abcde%3Aed2942d4%3A1f65231b%3Aa3b7d93f%3A5951aeec%3BTelerik.Web.UI.Skins%2C+Version%3D2014.3.1209.40%2C+Culture%3Dneutral%2C+PublicKeyToken%3D121fae78165ba3d4%3Aen-US%3Aef5dbad4-8876-491e-8893-6b349454b1fa%3A311bfd78%3A9aadcb00%3Ad041fe4f%3A579a1b90%3A3ad65a3&amp;__EVENTTARGET=RadTreeView3&amp;__EVENTARGUMENT=%7B%22commandName%22%3A%22Click%22%2C%22index%22%3A%220%3A3%3A0%22%7D&amp;__VIEWSTATE=Y2Q%2F%2F%2FYhmwnPV5X%2FCTSI66dNaZNkrFbNcsKNGXSMiM2NN6DM8OGgIJ1JS2RAEiWM43%2F2jmGQm3AglzaObIGc2oX1Y0qxwt1K0bmocMhcC6n5myemYiIgOl3y0%2B%2FlDgIUsFnEelQ%2BHZYNY6zfs9CIGD9c0bD00h0ao5qHMHolR%2B6ag9hvvXl7LsiYrxjVn1FKFf0aEY5N7Ic9OQNFjwSHBPRJCdDV6wSm03lyLuF4Sg6KjX2EYVRk7r4MGwWw3GtaaN8a2LZdiuWnQ%2BUY%2BXGYbJQfHOtO0TzkFY5A8BGMf7XNYL1PDYDAu8mPKbPlyBH0EHcsH792cq5%2BmVW2GDZnJnfqlRiCzrhJzelou6K7FnuQobLM5%2BC2VfBytfyAmZfaP70BhkRXNyBQ7x4iRu1w63Yy093zID0UWfUAaoqhhd36yViJYTUt%2FHudqKuQdhlG8xJ%2F7qLC8QinnG20ZrA%2FeQKkuev2OnWVoYurF07LA0pVS6BgfPrUQQYky6JKS2oIsed3Jvji1JeEQYEBLecAcUGLSMKbAHIwjdMrh6anZleyG5a55bhOYEVUdc9C2mQmZPUM7AF3rSp28O2i7nCi2VSnjTTsKLs4ndYolQO15VlQVhqLYcJOXfklb02rYAAeCWqChGFKucH8C9FvAQA4b%2Bw9dnrBL4UJ83J7cZeC36xZu1mARYayvcvAI%2BUYtOkQ7hW0czLDL%2BxCCaN%2BoxBRhC0CvirRdhp%2BYykgTb93LuOaXd5hQFA2imFWBdEY3EBDKd8ROSHrFfFQl47xyhprKMWc0gMUrLqIKoq8EdKNkIhIAuDcx0ZK07ZqyYyYV%2B7420AHDgMfYb%2FaYEliTRExUEtx%2FJyzdK7hisalyknzGVamcdvv4MBO48p5R8gHpggDm0xYZgIya4Sx5xxZHjT5F2HFLRo10xS1bPB9q%2ByXsbZLuXfVJGm7%2FTN2o8Xj7AiBrUETWj215CGSG5aLLqUGgRwyJ4d8%2FJWWrHGMEaylwc6%2Fq9o4ESXB4xpWdKyLUVzsTysDK1td1fCraqmIQQ2UtAHt9UVip9jMIFh77l61x84QpgKjhtcMQvtbbnaPJ%2FdDkMfY2hseNxUv2l2zPiOFqULU2LqcqcaCUpyyCbMgCuTFgH2cHLKIkz0vp4UnDDNmeT6pJm8qvAlk73nJjUUG4cdPMAsa%2F9rZnNHOCY7c3BZ%2Fd6gvxhn%2BjEE5IP22%2FVm2iVsCNjwfZVJZ8Gwhd%2B7bRf3Gqskp%2F0w1Ek73dTyVZWHHz546zsz5KtdYJNoaXoToOXnTwYFPyUs3TqjLkUT0R36AsWuVJ4MhD%2Fv6Sk7HWfHioHQuiyBIbG6wEAOr%2BiSKgYC4K8i%2FFDNqiv0zG0UAL%2FhRN7MmhzxMEYIa0r4np035sqh5nYaaeVZBKIvXEDU0CsgkqmI1Bnka44pUogrtU%2FQqvLBZVQXarN6Kpe2QE%2F2D2hQ795lAx3u%2FuSba0szrj5JZorC1ORO3d6S1eJGNh2XMiQUidPU6MEroNW%2BHjBYsME%2FqopTb432g56dYCv%2B9FdyLHyJ%2BV6DaCZk%2B0cfm4jmLHPC2c2VfbyIOM%2BMzFAa8kb06e8Sfs1tk2NCqfG%2FyalNn4fbRHwFxhLVYnMHTticwKc7mQizE0PZfsgSvUsXbigXEyfLasHVw%2ByA9Hifm7T6SKGL%2FDQR8afgKoJd17RUdEapJNUDu5P5HAoCipIBCx1auepddliizxeQ8FvyjDIe6%2FUkVr1IDxnMT0S7TO8uS7B%2FVVeRIq6%2BbC87LuztmUbHkRL9Fb70%2BsWEd9JBJFhBhObuqmqAPJ9RcqkCc7%2Bgg1O3mfZEtk7fyBOcxtLxk2GKSKRLAi9vjxWEE5FhwY1h%2Fn%2F5y9bqc1DMj%2FrQIZqHzkYFuD41s%2FV9d70RqirivcniutsGgxhEoGc6Ml4ur4ig4MrpTj8zEHzcKSXVkwBeC5UCCvXwcQ7Z4Vn%2F4%2BH%2FGatJcX9D0w%2Brs%2BJup%2BESApjB1RmJa%2BYooTUg3Q3UbHR1h0%2BGu5yPkctW2MgkjmINOowJQzHEK1mSzMEdLYEdbxJ1csWEoGMj2m1wRY5RARX8V7xyuX6%2BoYasgzcZ1MZXeoywl27QlYH4Zgj8Y4gPa2DBVYf5GimqrqSclKbiXC8628pkTE0YULiE9YSdtpyMsuSoRExqoIQON6ug92KsPbpDf5kYcJ8dtBTJUwLW8C46RA92eiMnaYhuwEi7sTDNju0ZM7RWyiejF0CiBKJdX1ypv%2FVSGxcIl%2Fnt1kiW02dPDvV7PyRS%2BZC8IFvfmbsNzx7XyRtgsDnulUpb8yJ2tnCMvMvozLhqrZGJhxdQ6zIeXuSh7LyaSa4PLDBmNK%2FEeDAZMB237UdMiSLjCBtKgxNMOsAEsD8KOlnt3zhiRwlM6%2FiLHgXElwfZreBx57fmr27C%2BN1LdDfqmBzfgbYKkHIufwB75RHHgP58hMJsS%2B0ubY4y7TxJDt3s5VhSPNn%2FG7UeuxhMneUhOqGpU9SY4KQd6YCscUR33RhQ2aaKPJcURWLgxW9yrP1CNLtehnqdtZxBdrBTnAAF8QWo7REcnQqzn3J82on2ADShtgUtnxsOeyIPJhmQCBuXUbut4fJlnJnSJSo4FWkM64NeSnpBg9%2BCAnyFY%2By7S%2BBMv66PTe6taVEEY8RcQb6h%2FbpwtTcphL9M3xVO0UMhaiEeTCZ%2BwgpKfVwKr6%2Be9jEa5aNEL8wZge4o%2FaOUsKEjoanU6LhTypcanHAu7gp9&nbsp;

youssef1 · Answer

hello,&nbsp;
The BIG-IP ASM system checks HTTP requests for unparsable content as part of HTTP compliance enforcement. When the HTTP parser cannot parse any part of an HTTP request, the system triggers a violation. This article lists the subviolation checks for HTTP protocol compliance that the system applies to HTTP content requests.&nbsp;
https://support.f5.com/csp/article/K44162352&nbsp;
increase this limit in the ASM instead of accepting(disabling) this violation in this menu: Security ›› Options : Application Security : Advanced Configuration : System Variables : ecard_max_http_req_uri_len.&nbsp;
Then restart asm service: tmsh restart sys service asm&nbsp;
Regards&nbsp;

prasad_chowdary · Answer

Hi Mohanad, &nbsp;
I ran in to the same issue, can you provide me the what you did to fix this issue.&nbsp;
Thanks in advance. &nbsp;
Thanks, 
Prasad Meka&nbsp;

Forum Discussion

Request Content-Length differs from actual request body length

3 Replies

F5 Academy at AppWorld 2026

Introducing the F5 AI Assistant for BIG-IP

Recent Discussions

Illegal Metacharacter in Parameter Name in Json Data

Cisco TACACS+ Config on ISE LTM Pair

Checking for X-Forwarded-For against an Address Data-Group

SSL Bridging and FQDN rewrite Policy

How can I get started with iCall

Related Content

Invalid Content-Length header caused Big-IP to terminate connection?

HTTP Request Smuggling Using Chunk Extensions (CVE-2025-55315)

Node.js HTTP Message Body: Transfer-Encoding and Content-Length in LineRate lrs/virtualServer Module

Request Content-Length differs from actual request body length.

Logging DNS Requests

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS