Project

General

Profile

Actions
Copy link

Feature #1285

closed

lighttpd-1.4.16 dont like requests with mixed "\r\n" and "\n".

Added by ralf almost 18 years ago. Updated about 1 year ago.

Status:
Fixed
Priority:
Low
Category:
core
Target version:
-
ASK QUESTIONS IN Forums:
No

Description

lighttpd-1.4.16 dont like requests with mixed "\r\n" and "\n".

Example (perl code):


print   "HEAD /index.html HTTP/1.0\r\n" .
        "Host: localhost\n"             .       # \n only
        "\r\n";

lighttpd waits some time and then kills the connection.
there is no logging for this request.

Actions
Copy link
 #1

Updated by admin almost 18 years ago

Does it work with all '\n'?

HTTP requires \r\n, so this isn't a bug in the web server but in the client.

Actions
Copy link
 #2

Updated by ralf almost 18 years ago

Replying to Olaf van der Spek:

Does it work with all '\n'?

No.

HTTP requires \r\n, so this isn't a bug in the web server but in the client.

Yes but rfc2616 #19.3 says: "The line terminator for message-header fields is the sequence CRLF. However, we recommend that applications, when parsing such headers, recognize a single LF as a line terminator and ignore the leading CR.".

So its not a bug, its a feature.

Actions
Copy link
 #3

Updated by glen about 17 years ago

  • Status changed from New to Fixed
  • Resolution set to wontfix
Actions
Copy link
 #4

Updated by stbuehler over 16 years ago

  • Status changed from Fixed to Wontfix
Actions
Copy link
 #5

Updated by gstrauss about 1 year ago

  • Description updated (diff)
  • Status changed from Wontfix to Fixed
  • Target version deleted (1.4.20)
  • ASK QUESTIONS IN Forums set to No

lighttpd enforces "\r\n" line endings since strict header parsing is enabled by default and modern HTTP RFCs recommend requiring CRLF line endings.

Since lighttpd 1.4.40, strict header parsing can be disabled (not recommended) using server.http-parseopts "header-strict"

Actions
Copy link

Also available in: Atom