Fetching a rating table doesn't return a content-length header

[DanielTOsborne]

Describe the bug
Fetching large rating tables don't have a "Content-Length" response header.

Expected behavior
Should be present all the time.

CURL Commands
curl -kIX "GET" "https://cwms-data.usace.army.mil/cwms-data/ratings?name=SPK%20HQ-Gushing%20River%20%40%20Hada.Stage%3BFlow.USGS-EXSA.Production&office=SPK&unit=EN&_cb=1778102184547" -H "accept: application/json" -H "Cache-Control: no-cache, no-store, max-age=0" -H "Pragma: no-cache"

CDA Version (please complete the following information):
At the top of any instance of CDA you will see a version. Please provide that version.

• Version 2026.03.31

Additional context

>curl -kIX "GET"   "https://cwms-data.usace.army.mil/cwms-data/ratings?name=SPK%20HQ-Gushing%20River%20%40%20Hada.Stage%3BFlow.USGS-EXSA.Production&office=SPK&unit=EN&_cb=1778102184547"   -H "accept: application/json"   -H "Cache-Control: no-cache, no-store, max-age=0"   -H "Pragma: no-cache"
HTTP/1.1 200
Date: Wed, 06 May 2026 21:16:58 GMT
Server: cwms-data-api
Set-Cookie: session=expiry=1778102818887253;Max-Age=600;httpOnly;secure;
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE, PUT
Content-Security-Policy: frame-src 'self' *.usace.army.mil *.sec.usace.army.mil *.ops.usace.army.mil *.cwbi.mil; frame-ancestors 'self' *.usace.army.mil *.sec.usace.army.mil *.ops.usace.army.mil *.cwbi.mil
Access-Control-Max-Age: 600
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=300
ETag: 3086381516
Content-Type: application/json;version=2
Set-Cookie: session=expiry=1778102818887253;Max-Age=600;httpOnly;secure;
Vary: Origin
Transfer-Encoding: chunked

Fetching a small (<8k) rating table did return a content-length:

>curl -kIX "GET"   "https://cwms-data.usace.army.mil/cwms-data/ratings?name=Bear-Outflow.Stage%3BFlow.USGS-EXSA.Production&office=SPK&unit=EN&_cb=1778102050383"   -H "accept: application/json"   -H "Cache-Control: no-cache, no-store, max-age=0"   -H "Pragma: no-cache"
HTTP/1.1 200
Date: Wed, 06 May 2026 21:15:30 GMT
Server: cwms-data-api
Set-Cookie: session=expiry=1778102730520846;Max-Age=600;httpOnly;secure;
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
Access-Control-Allow-Methods: POST, GET, OPTIONS, DELETE, PUT
Content-Security-Policy: frame-src 'self' *.usace.army.mil *.sec.usace.army.mil *.ops.usace.army.mil *.cwbi.mil; frame-ancestors 'self' *.usace.army.mil *.sec.usace.army.mil *.ops.usace.army.mil *.cwbi.mil
Access-Control-Max-Age: 600
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Cache-Control: max-age=300
ETag: 4213229320
Content-Type: application/json;version=2
Content-Length: 7195
Set-Cookie: session=expiry=1778102730520846;Max-Age=600;httpOnly;secure;
Vary: Origin

This is an issue in particular because there's a firmware bug in the Sutron SL3 where if you don't fetch the exact amount of bytes in the response, the process crashes. Granted that bug isn't your issue, but the workaround requires having a known content-length. They've acknowledged the bug and will be releasing a fix, but there's no ETA on that.

[rma-rripken]

In addition to the Content-Length being present/missing I see that it also switches to Transfer-Encoding: chunked. IMO chunked is a worse experience. That switch - between including the Content-Length and using chunked isn't something CDA actively controls. We use Javalin's method Context.result() in most places. Internally the result() method turns the provided String into a stream and has jetty handle the rest of the client/server response by sending (asynchronously I think) the stream to the client.

When implementing range-requests and streaming for Blob and Clob I found that Jetty would switch to chunked if the response didn't have the Content-Length set.

In the Controller we have the full response. We can convert it to bytes in the charset (UTF-8) to get the correct length, Set the Content-Length and, since we already have the byte-array we can write the bytes directly into the response output stream.

It would be easy to do for Ratings and see if that fixed the issue. If it does fix the issue we'd have to switch pretty much every controller from the default result() method which isn't ideal. This also might be fixed by moving to a more recent javalin.

[rma-rripken]

Replace:
ctx.result(results);
With something like:

byte[] bytes = results.getBytes(StandardCharsets.UTF_8);
ctx.header(Header.CONTENT_LENGTH, String.valueOf(bytes.length));
ctx.res.getOutputStream().write(bytes);