Transfer-Encoding: chunked framing on the connection
Transfer-Encoding describes how the body is framed on one connection, almost always chunked, which lets a server start sending before it knows the total length.
At a glance
- Direction
- Both, but hop by hop: it applies to a single connection, not end to end.
- Defined in
- RFC 9112, which covers HTTP/1.1 message syntax
- When absent
- The body length comes from Content-Length, or from the connection closing.
- Usual value
- chunked, which must be the final coding if others are listed
- Scope
- One hop. A proxy may remove it and send the body a different way.
- Forbidden in
- HTTP/2 and HTTP/3, which frame messages themselves
- Never send with
- Content-Length, in the same message
In detail
Chunked framing sends the body as a series of pieces, each prefixed with its size in hexadecimal, ending with a zero length chunk. That means a server can start writing a response before it knows how long it will be, which is what makes streamed output and server sent events possible on HTTP/1.1 without closing the connection to signal the end.
It is hop by hop, which is the property people miss. A proxy is free to receive a chunked body and forward it with a Content-Length, or the reverse, because the framing belongs to the connection rather than to the representation. That is exactly the difference from Content-Encoding, which travels untouched from origin to client.
A message carrying both this header and Content-Length is ambiguous, and receivers must treat it as an error rather than picking one. Attackers rely on middleboxes disagreeing about which to honour, so that one request is read as two, with the second one smuggled past whatever inspects the first. Frameworks that let application code set both headers by hand are worth auditing for exactly this.
HTTP/2 and HTTP/3 removed it. Those protocols carry lengths in their own frame headers, so a chunked encoding line is not merely redundant but forbidden, and a connection carrying one is treated as malformed. Code that inspects this header therefore needs to cope with it simply not existing on a modern connection.
Examples
HTTP/1.1 200 OK
Content-Type: text/plain
Transfer-Encoding: chunked
7
Mozilla
9
Developer
0
Each chunk is prefixed with its length in hexadecimal, and a zero length chunk ends the body.
HTTP/1.1 200 OK
Content-Type: text/event-stream
Cache-Control: no-store
Transfer-Encoding: chunkedThings that catch people out
- Sending Content-Length alongside chunked framing is not belt and braces, it is an ambiguous message that receivers are required to reject.
- The header does not survive a hop. Looking for it at the client to work out whether the origin streamed the response tells you nothing.
- Buffering proxies can collect the whole chunked body before forwarding it, which defeats streaming without changing a single header.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Content-Length: the size of the body in octets
What Content-Length counts, why it must never accompany Transfer-Encoding, what happens when it disagrees with the body, and when it may be omitted.
Content-Encoding: what compression was applied
What Content-Encoding declares, how it differs from Transfer-Encoding, why it changes the ETag, and how double compression happens in a proxy chain.
Connection: keep-alive, close and hop by hop headers
What the Connection header controls, how it lists hop by hop headers, why HTTP/1.1 keeps connections open by default, and why HTTP/2 forbids it.
Upgrade: switching protocols on an open connection
How the Upgrade header negotiates a protocol switch, what a 101 response means, why proxies break WebSocket handshakes, and what HTTP/2 does instead.
User-Agent: what the client says it is
Why User-Agent strings look the way they do, why browsers are freezing and reducing them, and what to use instead of parsing one for feature decisions.
Access-Control-Allow-Origin: who may read this response
How the allow origin header is matched, why a wildcard fails with credentials, why it takes only one origin, and why Vary: Origin is mandatory when you echo.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL