I am trying to upload a file to document library using below code.

function uploadDocument(buffer, fileName) {
            ohrIDFolder = $("#ohrID").val();
            var actualFolder = "EFMSEmployeeDocumentList" + "/" + topFolder;
            var url = String.format(
                "{0}/_api/web/GetFolderByServerRelativeUrl('" +actualFolder+"')/Files/Add(url='{1}', overwrite=true)",
                _spPageContextInfo.webAbsoluteUrl, fileName);

            var call = jQuery.ajax({
            url: url,
            type: "POST",
            data: buffer,
            processData: false,
            headers: {
                        Accept: "application/json;odata=verbose",
                        "X-RequestDigest": jQuery("#__REQUESTDIGEST").val(),
                        "Content-Length": buffer.byteLength

            return call;

So I am getting this error Refused to set unsafe header "Content-Length".

What should I do to solve this error?

  • The snippet above seems to be very similar to the API example from Microsoft Docs.
    – Nae
    Oct 15, 2018 at 8:34

2 Answers 2


Remove "Content-Length": buffer.byteLength from your code, it will be set automatically when the browser executes the call.

More information in answers here


Yes, the [standard][1] says it must:

For security reasons, these steps should be terminated if header is [...]

  • Connection
  • Content-Length

Messing around with those could expose various request smuggling attacks, so the browser always uses its own values. There's no need or reason to try to set the request length, as the browser can do that accurately from the length of data you pass.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.