title: can an http client lie about a request's content-length?
body: <p>specifically, i'm talking about from the point of view of a node.js server. it's hard to test this in node.js because <code>http.client</code> validates <code>content-length</code>. </p>
  
  <p>can a client lie about a body's content-length, at least at the point it reaches <code>http.createServer().on('request')</code>?</p>
  
  <ul>
  <li>Can a client send a body that is larger than <code>content-length</code>? I don't think this is possible as it is most likely checked at the parser level, but i want proof.</li>
  <li>Can a client send a body that is smaller than <code>content-length</code>? I think this may be true.</li>
  </ul>
  
  <p>i'm worried about malicious users that may not use a well-behaved http client.</p>