Cloudflare and Apache/PHP-FPM: POST request bodies arriving empty
Investigation into the issue of empty POST request bodies with Cloudflare and Apache/PHP-FPM. Causes and implications.
Recently, all POST requests to sites running Apache + PHP 8.4 behind Cloudflare are arriving with empty bodies. Although the server correctly sees the payload, PHP reports every field as missing. The issue seems to stem from Cloudflare losing the Content-Length header when re-framing requests from HTTP/2 or HTTP/3 to HTTP/1.1.