title: Is HTTP Content-Length Header Safe to Trust?
body: <p>Is it safe to trust the <code>Content-Length</code> HTTP header? According to the <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Length" rel="noreferrer">MDN docs</a> it is a <code>Forbidden header name</code>. If I go to <a href="https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name" rel="noreferrer">that page</a> it says the following.</p>
  
  <blockquote>
    <p>Modifying such headers is forbidden because the user agent retains full control over them.</p>
  </blockquote>
  
  <p>But wouldn't there still be a way to spoof these values if you control the user agent?</p>
  
  <p>I'm just trying to figure out how safe it is to trust those headers on that  <a href="https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name" rel="noreferrer"><code>Forbidden header name</code></a> page and if they are able to be spoofed at all.</p>