The toy example keeps its boundary narrow.
What this toy model checks
The trust boundary parses the request, splits the response, counts the body bytes, and compares the count with Content-Length.
recompute body length \text{recompute body length} recompute body length Content-Length honesty boundary The body bytes and Content-Length check are recomputed from pinned response bytes. Content-Length honesty boundary - 200 OK body hello is 5 bytes, Content-Length 5 section name value check request line method GET parsed request line path /hello.txt parsed request line version HTTP/1.1 parsed header Host static.example exact header Accept text/plain exact status version HTTP/1.1 parsed status status 200 OK ok header Content-Type text/plain exact header Content-Length 5 declared bytes body text hello after blank line body hex 68656c6c6f ASCII bytes body byte length 5 counted check Content-Length 5 declared check body bytes 5 recomputed check match yes same number
Honesty boundary
NOTE: toy HTTP response length only; not chunked transfer, compression, trailers, multiple responses, streaming, range requests, framing, charset negotiation, MIME sniffing, security policy, or production web server config.
toy response length only \text{toy response length only} toy response length only Content-Length honesty boundary The body bytes and Content-Length check are recomputed from pinned response bytes. Content-Length honesty boundary - 200 OK body hello is 5 bytes, Content-Length 5 section name value check request line method GET parsed request line path /hello.txt parsed request line version HTTP/1.1 parsed header Host static.example exact header Accept text/plain exact status version HTTP/1.1 parsed status status 200 OK ok header Content-Type text/plain exact header Content-Length 5 declared bytes body text hello after blank line body hex 68656c6c6f ASCII bytes body byte length 5 counted check Content-Length 5 declared check body bytes 5 recomputed check match yes same number
No client compute
The page shows already validated rows. It does not count body bytes in browser code.
static validated rows \text{static validated rows} static validated rows Content-Length honesty boundary The body bytes and Content-Length check are recomputed from pinned response bytes. Content-Length honesty boundary - 200 OK body hello is 5 bytes, Content-Length 5 section name value check request line method GET parsed request line path /hello.txt parsed request line version HTTP/1.1 parsed header Host static.example exact header Accept text/plain exact status version HTTP/1.1 parsed status status 200 OK ok header Content-Type text/plain exact header Content-Length 5 declared bytes body text hello after blank line body hex 68656c6c6f ASCII bytes body byte length 5 counted check Content-Length 5 declared check body bytes 5 recomputed check match yes same number
Summary
Headers come first, then the body; Content-Length counts the body bytes.
Content-Length counts body \text{Content-Length counts body} Content-Length counts body Content-Length honesty boundary The body bytes and Content-Length check are recomputed from pinned response bytes. Content-Length honesty boundary - 200 OK body hello is 5 bytes, Content-Length 5 section name value check request line method GET parsed request line path /hello.txt parsed request line version HTTP/1.1 parsed header Host static.example exact header Accept text/plain exact status version HTTP/1.1 parsed status status 200 OK ok header Content-Type text/plain exact header Content-Length 5 declared bytes body text hello after blank line body hex 68656c6c6f ASCII bytes body byte length 5 counted check Content-Length 5 declared check body bytes 5 recomputed check match yes same number