400 Bad Request: Invalid Request Framing

Membrane API Gateway returns 400 Bad Request with a link to this page when its HTTP server receives a request whose header section or body framing is invalid. This happens before any API is selected. Membrane then closes the connection to prevent HTTP request smuggling.

The Error Response

The response contains the status 400 Bad Request, a detail that names the offending header, the problem type https://membrane-api.io/problems/user and a link to this page. The type user means that the client, or a proxy in front of Membrane, sent an invalid request.

Why Membrane Is Strict About Framing

The length of an HTTP/1.1 request body is determined by Content-Length or Transfer-Encoding: chunked. If these headers are ambiguous, a proxy and a backend may disagree on where one request ends and the next begins. Attackers use that to smuggle requests past security checks. RFC 9112, section 6.3, therefore requires such requests to be rejected and the connection to be closed.

Common Causes

Conflicting or Invalid Content-Length

The request has several Content-Length values that differ, in separate fields or as a comma-separated list, or a Content-Length that is not a non-negative integer.

Transfer-Encoding Does Not End with Chunked

The last coding in Transfer-Encoding is not chunked, so the length of the body cannot be determined.

A Folded Header Line

A header line has no field name followed by a colon. Most often this is an obsolete folded continuation line, a line that starts with whitespace.

An Invalid Field Name

A field name contains whitespace or a control character. This includes whitespace between the field name and the colon, as in Content-Type : text/plain, which is rejected rather than trimmed.

How to Fix It

1. Client: send exactly one valid Content-Length, or use Transfer-Encoding: chunked as the final coding, never both in conflicting form.
2. Client: send each header on one line as Name: value, with no folding and no whitespace before the colon.
3. Operator: the detail of the response and the debug-level log line Rejecting request with invalid framing name the offending header.
4. Operator: if a proxy or load balancer in front of Membrane creates such requests, fix it there.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---.

Related Documentation

Configuration reference:

• api
• transport

← All Membrane error messages