IIS php fastcgi and chunked request body

Question

IIS php fastcgi and chunked request body

Jan Vávra 446

I've found out IIS doesn't support a chunked request bodies, eg.

enter image description here

I found a mention:

In HTTP/1.1, chunked transfer encoding is primarily a server-side response mechanism. The specification (RFC 9112, previously RFC 7230 and RFC 2616) defines chunked encoding as a way for the server to send responses when the content length is unknown in advance.

However, HTTP/1.1 does allow chunked requests, but support for them is optional for servers. Many web servers, including IIS, do not support chunked request bodies, meaning they do not accept incoming requests that use chunked transfer encoding.

Anyway. In my scenario the curl never returns and still blocks a IIS/php-cgi.exe process. On a second request it starts second php fastcgi php-cgi.exe process untill a maximum configured (eg. 16).

In that case everything is blocked and no other clients like browser are served by php-cgi.

Still I can get a static content but the php application is stucked.

Why IIS doesn't respond something like HTTP 400 Bad Request etc. ?

Can I still configure IIS to accept chunked request bodies?

Jan.

Lex Li 6,037 Reputation points

2025-03-18T22:02:00.13+00:00

There are quite a few similar issues related to IIS chunked support. (You might want to read posts like this and etc.) In short, to investigate/resolve such issues, the guy will need both IIS/PHP knowledge, which isn't an easy task. But Microsoft no more supports PHP on IIS/Windows, https://docs.lextudio.com/phpmanager/getting-started/supported-platforms#php-on-windows-status So your first option is maybe to move to Linux where there is a stronger PHP community.
Anonymous

2025-03-19T09:01:20.2566667+00:00

Hi @Jan Vávra,

Can I still configure IIS to accept chunked request bodies?

As mentioned in your problem description, this encoding format is used to send the response, not to parse the request body. You may need to understand how chunking works and implement this requirement through logic code.
Jan Vávra 446 Reputation points

2025-03-19T09:51:05.7233333+00:00

@Anonymous

Definitely it is a client request, see the curl command.
And this can even cause a Denial of Service. All fastcgi php-cgi.exe processes become stucked and no other php pages are served until a fastcgi timeout occurs.

Answer accepted by question author

0 additional answers

Your answer

Lex Li 6,037 Reputation points

2025-03-18T22:02:00.13+00:00

There are quite a few similar issues related to IIS chunked support. (You might want to read posts like this and etc.) In short, to investigate/resolve such issues, the guy will need both IIS/PHP knowledge, which isn't an easy task. But Microsoft no more supports PHP on IIS/Windows, https://docs.lextudio.com/phpmanager/getting-started/supported-platforms#php-on-windows-status So your first option is maybe to move to Linux where there is a stronger PHP community.
Anonymous

2025-03-19T09:01:20.2566667+00:00

Hi @Jan Vávra,

Can I still configure IIS to accept chunked request bodies?

As mentioned in your problem description, this encoding format is used to send the response, not to parse the request body. You may need to understand how chunking works and implement this requirement through logic code.
Jan Vávra 446 Reputation points

2025-03-19T09:51:05.7233333+00:00

@Anonymous

Definitely it is a client request, see the curl command.
And this can even cause a Denial of Service. All fastcgi php-cgi.exe processes become stucked and no other php pages are served until a fastcgi timeout occurs.

Answer 1

Hi @Jan Vávra,

You're right that HTTP/1.1 allows chunked transfer encoding. However, IIS does not currently support chunked request bodies for incoming requests. When such a request is received, IIS passes it to the FastCGI handler (like php-cgi.exe), which may not handle it correctly.

This can result in the request not completing as expected. IIS does not reject the request with a 400 error because it doesn't detect the chunked body as invalid.

Why doesn't IIS return a 400 Bad Request?

Because IIS doesn't detect the request. So, it doesn't know that it's supposed to reject chunked requests. It just silently passes them onto PHP, which hangs.

Can IIS be configured to accept chunked request bodies?

At this time, there is no built-in support in IIS for handling chunked request bodies. Configuration options are limited, especially when using PHP with FastCGI.

Workarounds:

Avoid chunked uploads by configuring the client to send a Content-Length header instead.
Adjust FastCGI settings like requestTimeout and activityTimeout to reduce the impact of long-running processes. See: FastCGI settings in IIS
Consider alternative platforms such as Linux with nginx or Apache if chunked uploads are required.

Tom Tran (WICLOUD CORPORATION) 3,320 Reputation points Microsoft External Staff Moderator

2025-07-04T10:56:29.87+00:00

Hi @Jan Vávra,

Just wanted to follow up and see if you’ve had a chance to try out the suggestions I shared. Let me know how things are going — happy to help if you’re still running into issues!
Jan Vávra 446 Reputation points

2025-12-11T13:43:12.52+00:00

We resolved it by denying the entire Transfer-Encoding Header:
inetmgr / root IIS / Request Filtering / Add Header
The Czech labels are:

Header:
Limit of the size:

Then any request coming with request header "Transfer-Encoding: whatever" will fail with
HTTP/1.1 431 Request Header Fields Too Large

Share via

IIS php fastcgi and chunked request body

0 additional answers

Your answer