Project

General

Profile

server.http-parseopts option

server.http-parseopts

HTTP request parsing and normalization options (since 1.4.50)

  • any url-normalize* option enabled results in:
    • uppercase %XX percent-encodings
    • percent-encode any chars not in unreserved or reserved sets (RFC 3986)
  • "url-normalize" => "enable"
    • equivalent to "url-normalize-unreserved" and "url-path-2f-decode"
  • "url-normalize-unreserved" => "enable"
    • decode unreserved chars if percent-encoded (alphanumeric '-' '.' '_' '~')
  • "url-normalize-required" => "enable"
    • decode unreserved and reserved chars if percent-encoded (unreserved, delims, sub-delims)
  • "url-ctrls-reject" => "enable"
    • reject any percent-encoded control chars
  • "url-path-backslash-trans" => "enable"
    • translate backslash to slash (if lighttpd is running on Windows)
  • "url-path-2f-decode" => "enable"
    • translate %2F to /
  • "url-path-2f-reject" => "enable"
    • reject %2F
  • "url-path-dotseg-remove" => "enable"
    • resolve and remove "." and ".." path segments
  • "url-path-dotseg-reject" => "enable"
    • reject "." and ".." path segments
  • "url-query-20-plus" => "enable"
    • translate %20 to '+' in query-string (if present)
  • "header-strict" => "enable"
    • restrict chars permitted in HTTP request headers (overrides server.http-parseopt-header-strict)
  • "host-strict" => "enable"
    • restrict chars permitted in HTTP request Host header (overrides server.http-parseopt-host-strict)
  • "host-normalize" => "enable"
    • normalize HTTP Host header (overrides server.http-parseopt-host-normalize)

Example

server.http-parseopts = ( "url-normalize" => "enable", ... ) 

Updated by gstrauss 4 months ago · 1 revisions