tree 887b2761773d148bd757f24307ef6c1706918be0
parent ae053b30da4db588f7fabe09e5f85cbebdc421ad
author Christopher Faulet <cfaulet@haproxy.com> 1652426413 +0200
committer Christopher Faulet <cfaulet@haproxy.com> 1652436264 +0200

MINOR: mux-h1: Add global option accpet payload for any HTTP/1.0 requests

Since the 2.5, for security reason, HTTP/1.0 GET/HEAD/DELETE requests with a
payload are rejected (See e136bd12a "MEDIUM: mux-h1: Reject HTTP/1.0
GET/HEAD/DELETE requests with a payload" for details). However it may be an
issue for old clients.

To avoid any compatibility issue with such clients,
"h1-accept-payload-with-any-method" global option was added. It must only be
set if there is a good reason to do so because it may lead to a request
smuggling attack on some servers or intermediaries.

This patch should solve the issue #1691. it may be backported to 2.5.