Is it safe to remove Content-Type and Expect headers from HTTP POST request with empty body? #22894

The headers are a symptom of the body size being unknown rather than something to strip. CURLOPT_POST on its own leaves CURLOPT_POSTFIELDSIZE at its default of -1, and it is that unknown length which makes libcurl reach for chunked encoding and for Expect: 100-continue. In lib/http.c the Expect header goes in when client_len > EXPECT_100_THRESHOLD || client_len < 0, so a known length of zero suppresses it without you touching the header list at all.

So set the size explicitly:

curl_easy_setopt(curl, CURLOPT_POST, 1L);
curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, 0L);

That sends Content-Length: 0, with no Expect and no chunked encoding. If you also want the Content-Type gone, adding Content-Type: to CURLOPT_HTTPHEADER is supported and safe, and gives you:

POST /x HTTP/1.1
Host: example.com
Accept: */*
Content-Length: 0

The one thing worth avoiding is removing Transfer-Encoding as well. Do that and the request goes out with no Content-Length and no Transfer-Encoding at all. RFC 9112 section 6.3 rule 7 does say a request with neither has a zero-length body, so it is not malformed, but a good many servers reply 411 Length Required, and proxies tend to treat unframed POSTs with suspicion. Content-Length: 0 is what you want on the wire.

@kebl3541
I appreciate your recommendations, but what if I prefer not to send Content-Type, Expect, and Transfer-Encoding? Can I safely remove these headers from a curl perspective?

CURLOPT_HTTPHEADER documentation says:

If you provide a header that is otherwise generated and used by libcurl internally, your header alternative is used instead. If you provide a header without content (no data on the right side of the colon) as in Accept:, the internally used header is removed.
...
There are exceptions when suppressing headers. The Connection: header in HTTP/1.1 cannot be overridden. You can provide values for it, but should a request require specific ones, they are always added to your own.

The documentation explicitly states that the Connection header value cannot be overridden; however, the Content-Type, Expect, and Transfer-Encoding headers are not mentioned in the list of exceptions. Does this mean that, from curl's perspective, these headers can be safely removed?