I noticed that our IIS 8.5 returns "
401 Unauthorized" response to non-authenticated HTTP request right after receiving its headers, without waiting for the body:
POST /some/protected/page HTTP/1.1 Host: server.example.org Content-Length: 4666
the server, without waiting for the rest:
HTTP/1.1 401 Unauthorized Server: Microsoft-IIS/8.5
the client goes on:
<xml>some large XML block of 4666 bytes in total</xml>
Now, by itself it doesn't represent a problem, but our load balancer (FortiGate v6.0.3) decided to be smart, so it drops the request's body after seeing the "
401 Unauthorized" response. And this, as I understand, causes next request over the same TCP pipe to fail, since the server interprets next bytes as a payload promised by the "
Content-Length: 4666" header.
The question: is it possible to make IIS to wait for the whole request before responding with