Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
991 Views 3 Replies Latest reply: Oct 31, 2013 2:30 AM by timode RSS
Troja Champion 256 posts since
Aug 26, 2010
Currently Being Moderated

Dec 19, 2012 4:35 AM

Content-Encoding Header vs. chunked encoding

Hi all,

i discussed a behavior with a customer. Can anyone give me a hint?

 

When a client connects to MWG the HTTP request header shows the following header.

ContentEncoding:  gzip

 

MWG itself removes this header completely and an additional header is added.

TransferEncoding:  chunked

 

My questions are:

- is this a normal behavior?

- is this behavior ducumented in any RFC?

- is it possible to configure MWG to send the ContentEncoding Header anyway?

 

Best,

Thorsten

  • asabban McAfee SME 1,354 posts since
    Nov 3, 2009
    Currently Being Moderated
    1. Dec 20, 2012 2:40 AM (in response to Troja)
    Re: Content-Encoding Header vs. chunked encoding

    Hello,

     

    if responses from web servers are encoded MWG will decode them in order to apply filters. Because re-encoding would take a lot of resources MWG does not re-encode any traffic but sends it to the client decoded. One of the reasons to use encoding is to save bandwidth and the usual use case for a proxy is to have it in-house, so this behaviour is as designed.

     

    I don't think that this behaviour is forbidden by RFCs. Both connections (Client <-> MWG and MWG <-> Server) are valid HTTP connections.

     

    I have seen a couple of FMRs to keep the gzip encoding, but as far as I know at the moment this is only possible by calling an HTTP Tunnel event and do not parse the response through the rule engine, which means it will not be filtered.

     

    Best,

    Andre

  • timode Newcomer 2 posts since
    Oct 31, 2013
    Currently Being Moderated
    3. Oct 31, 2013 2:30 AM (in response to Troja)
    Re: Content-Encoding Header vs. chunked encoding

    Hi,

     

    are there any plans on this? Would be great to be able to control this behaviour.

     

    cheers

    Timo

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points