Does ZAP sometimes chunk proxied requests?

65 views
Skip to first unread message

Ed MacDonald

unread,
Feb 12, 2021, 2:37:40 PM2/12/21
to OWASP ZAP User Group
We've got an application that uses okHttp to send requests to an API, and we've mocked that API out with a simple node server that listens for requests and sends back pre-determined responses. So a lot of moving parts. But I think I've eliminated everything but Zap. 

Can someone confirm whether it's possible that Zap is taking a request (with a Content-Length header) and, upon proxying it, removing the Content-Length, setting Transfer-Encoding to "chunked", and then passing on the request (in chunks, I presume)? If so, can I turn this off?

How I tested:

Our mock API server can't handle chunked requests. When I put Zap as a proxy between our App (client) and the mock API server, it breaks. I see the okhttp logs stating that the request being sent has a Content-Length header, but when I log the request in the mock API server, it's not there and I see Transfer-Encoding: chunked.

When I replace Zap with "HTTP Toolkit" (I'm running on a mac), everything works.

Thanks,
Ed

Ed MacDonald

unread,
Feb 12, 2021, 3:32:07 PM2/12/21
to OWASP ZAP User Group
Well, I just noticed that HTTP Toolkit is also sending "Transfer-Encoding: chunked" ... so I have no idea what's going on.
Reply all
Reply to author
Forward
0 new messages