Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #178570

Re: why does latest jessie apache2 reject _ in http request path?

Show all headers | View raw

Juha Heinanen writes:

> Thanks for your answer.  The request below works over TLS in apache2
> 2.4.10-10+deb8u7, but fails in 2.4.10-10+deb8u8 unless I turn on
> 
> #HttpProtocolOptions unsafe
> 
> There is crlf after each line and there are no tabs.
> 
> I can't figure out what is wrong with it.

Now when I compare HTTP version of the client to HTTPS version, I see
difference.  The client is written in PHP and if HTTP is used, the
request is set like this:

        $headers =
	"POST $location HTTP/1.1\r\n" .
	"Host: $site\r\n" .
	"Connection: close\r\n" .
	"Content-Type: text/xml\r\n" .
	"Content-Length: " . strlen($data) . "\r\n\r\n";

But if HTTPS is used, the request is set like this:

	curl_setopt($curl, CURLOPT_HTTPHEADER,
	  array('Content-Type: text/xml',
	    'POST $location HTTP/1.1',
 	    'Host: $site',
 	    'Connection: close',
	    'Content-Type: text/xml',
	    'Content-Length: ' . strlen($data)));

Perhaps curl_setops() does not properly add crlf after each header line?
I'll investigate.

-- Juha

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

why does latest jessie apache2 reject _ in http request path? Juha Heinanen <jh@tutpro.com> - 2017-03-08 08:20 +0100
  Re: why does latest jessie apache2 reject _ in http request path? <tomas@tuxteam.de> - 2017-03-08 10:20 +0100
    Re: why does latest jessie apache2 reject _ in http request path? Juha Heinanen <jh@tutpro.com> - 2017-03-08 10:40 +0100
      Re: why does latest jessie apache2 reject _ in http request path? Juha Heinanen <jh@tutpro.com> - 2017-03-08 10:50 +0100
      Re: why does latest jessie apache2 reject _ in http request path? tomas@tuxteam.de - 2017-03-08 11:00 +0100
  Re: why does latest jessie apache2 reject _ in http request path sf@debian.org - 2017-03-08 12:00 +0100
    Re: why does latest jessie apache2 reject _ in http request path Juha Heinanen <jh@tutpro.com> - 2017-03-08 21:10 +0100
      Re: why does latest jessie apache2 reject _ in http request path Greg Wooledge <wooledg@eeg.ccf.org> - 2017-03-08 21:10 +0100

csiph-web