Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

4.x: Fail more gracefully for HTTP/1.0 #9648

Open
tomas-langer opened this issue Jan 10, 2025 · 0 comments
Open

4.x: Fail more gracefully for HTTP/1.0 #9648

tomas-langer opened this issue Jan 10, 2025 · 0 comments
Labels
4.x Version 4.x enhancement New feature or request webserver

Comments

@tomas-langer
Copy link
Member

Currently we:

  • Log FINE io.helidon.webserver.http1.Http1Connection: io.helidon.http.RequestException: Invalid protocol and/or version
  • Return 400 Bad Request

Event though this is functionally correct, as we do not support HTTP/1.0, it may be better to do a bit more:

  • Log (still in FINE, must not use any level above it): "Unsupported protocol: HTTP/1.0" - make sure the text taken from the request is clean, as it is user provided, so it may contain attempts to attack us (there are already tools for that, see header validation)
  • Return 505 HTTP Version Not Supported for the case we get any other version than 1.1 for HTTP, sending a descriptive message in the entity (i.e. HTTP/1.0 is not supported, please use HTTP/1.1 or something similar) (again make sure the returned value is a valid string)

This is a follow up for #9604

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
4.x Version 4.x enhancement New feature or request webserver
Projects
Status: Triage
Development

No branches or pull requests

1 participant