tree 0fcac2e472d9055e1ad776676fc9f1ec41a06159
parent b3230f76e8540825aa003a58424aadc049b9ae51
author Christopher Faulet <cfaulet@haproxy.com> 1632242695 +0200
committer Christopher Faulet <cfaulet@haproxy.com> 1632838871 +0200

MEDIUM: mux-h1: Reject HTTP/1.0 GET/HEAD/DELETE requests with a payload

This kind of requests is now forbidden and rejected with a
413-Payload-Too-Large error.

It is unexpected to have a payload for GET/HEAD/DELETE requests. It is
explicitly allowed in HTTP/1.1 even if some servers may reject such
requests. However, HTTP/1.0 is not clear on this point and some old servers
don't expect any payload and never look for body length (via Content-Length
or Transfer-Encoding headers).

It means that some intermediaries may properly handle the payload for
HTTP/1.0 GET/HEAD/DELETE requests, while some others may totally ignore
it. That may lead to security issues because a request smuggling attack is
possible.

To prevent any issue, those requests are now rejected.

See also httpwg/http-core#904