2026-09-18 · 8 min read
- http
- uploads
- proxies
Expect: 100-continue lets an HTTP client ask whether it should send a request body after transmitting the headers. The origin or an intermediary can reject authentication, authorization, method, or size problems before a costly upload crosses the network.
The optimization adds a multi-stage exchange. Client fallback timers, proxy buffering, protocol translation, and application body readers must agree well enough to avoid a deadlock or an unnecessary delay on every request.
Define ownership of the expectation
Decide whether the edge, application server, or application code evaluates the request headers and emits the interim response. Document which checks can run before body consumption and which component enforces each size limit.
- Authenticate and validate header-only constraints before accepting the body.
- Return a final error directly when the request is already unacceptable.
- Send 100 Continue only when body transmission may proceed.
- Keep the final application response distinct from every interim response.
Bound waiting and buffering
A compliant client may wait for 100 Continue and then send the body after a short fallback interval. Measure that interval and align proxy upstream timeouts so no hop waits indefinitely for another hop to act first.
Buffering can protect an origin but moves memory, disk, and timeout pressure to the proxy. Set explicit body-size, buffering, idle, and total-duration limits for the deployed traffic profile.
Make retries representation-safe
A client that receives an early final response should not send the body on that exchange. If it retries after a connection failure, the endpoint still needs its ordinary idempotency policy; the Expect handshake does not prove the application operation was never committed.
Redirect behavior for body-bearing requests must also be intentional. Preserve or change the method only according to the status semantics and avoid forwarding credentials or upload bodies to an untrusted authority.
Test the complete production route
Use Flashman's URL tool for targets and redirects, timestamp converter for event timelines, units converter for byte limits, diff for sanitized proxy settings, and hash tool for public fixture integrity.
Cover accepted and rejected headers, empty and oversized bodies, immediate and delayed interim responses, no 100 response, early final errors, fixed-length and streamed bodies, redirects, disconnects, retries, connection reuse, HTTP version translation, and every gateway in the deployed path.