Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Post Mortem: A single whitespace character

eatabit.com

Post reply on HN
Print view View original

41–50 of 209 posts

Re: Post Mortem: A single whitespace character

#41

Post by codehero »

jrochkind1 wrote: post #7

This very example -- requests were technically illegal all the time without devs realizing, but something in the stack changed to start rejecting them -- demonstrates the fallacy of the "be liberal in what you accept, strict in what you issue" principal. If all the web servers involved had been strict in rejecting the illegal request from the start, they would have noticed the bug in development before deploying to f…

I have to agree. I developed a proprietary embedded web server using a streaming HTTP parser. Complying with the HTTP parsing rules is a headache to say the least. Variable amounts of whitespace; 2 variants of line terminators (\r\n or \n) with the provision that the latter SHOULD be accepted by the server and line continuations make complying with the whole specification a real pain if you only have 100 bytes to parse pieces of your request.

Maybe for a server with massive resources (I am talking about megabytes of RAM compared to kilobytes I work with) being liberal in what you accept works, but not when you are on a budget.

Re: Post Mortem: A single whitespace character

#42

Post by userbinator »

I saw it right away - "that HTTP/1.1 looks a bit farther away than it should be..." - and confirmed it by selecting the spaces. I thought it would be a bit more subtle than that... I remember working with a server that violated the HTTP spec by not accepting allowed extra spaces in headers.

According to the new HTTP/1.1 RFC 7230, it should be a single space - the previous RFC didn't specify this clearly in the wording, although it is implied by the grammar (SP and not 1 * SP).

https://tools.ietf.org/html/rfc7230#section-3.1.1

"A request-line begins with a method token, followed by a single space (SP), the request-target, another single space (SP), the protocol version, and ends with CRLF."

I'm surprised there doesn't seem to be any widely-used and easily available HTTP conformance checker - unlike the well-known HTML validators.

This is also why monospace fonts are ideal for seeing small but significant differences like this.

Re: Post Mortem: A single whitespace character

#43

Post by stevekemp »

rcconf wrote: post #12

I've had the same issues when developing with Flask in Python. I forgot to URL encode some query parameters and it worked fine with the local HTTP server. But when I put nginx in front as a proxy, it denied all requests.

The thttpd webserver doesn't handle requests with too many slashes either, which I only found out recently

This is treated as an invalid request:

      http://example.com//robots.txt

Re: Post Mortem: A single whitespace character

#44

Post by jrockway »

ultrafez wrote: post #35
spindritf wrote: post #26

Earlier quoted context omitted.

Yeah, why is every image, heading, and paragraph on that page surrounded by scrollbars where most don't work and are not necessary?

In their CSS, they have a rule for every tag to have "overflow: scroll" for some reason. Not sure why they didn't use the default value for overflow, since there's nothing on that page that needs to be specifically told to scroll.

Probably, they tried it and it worked.

This incidentally led to the bug that they're blogging about too.

Re: Post Mortem: A single whitespace character

#45

Post by zimpenfish »

stevekemp wrote: post #43
rcconf wrote: post #12

I've had the same issues when developing with Flask in Python. I forgot to URL encode some query parameters and it worked fine with the local HTTP server. But when I put nginx in front as a proxy, it denied all requests.

The thttpd webserver doesn't handle requests with too many slashes either, which I only found out recently This is treated as an invalid request: http://example.com//robots.txt

Unless I'm reading RFC 3986 incorrectly, that's valid because you can't have an empty segment in the path part of a URI.

Re: Post Mortem: A single whitespace character

#46

Post by michaelmior »

userbinator wrote: post #42

I saw it right away - "that HTTP/1.1 looks a bit farther away than it should be..." - and confirmed it by selecting the spaces. I thought it would be a bit more subtle than that... I remember working with a server that violated the HTTP spec by not accepting allowed extra spaces in headers. According to the new HTTP/1.1 RFC 7230, it should be a single space - the previous RFC didn't specify this clearly in the wordin…

That's an interesting idea. It would be useful to have a Web server where the output is just a conformance check of the request. That might be a fun project for a rainy day :)

Re: Post Mortem: A single whitespace character

#47

Post by dceddia »

goleksiak wrote: post #33
spindritf wrote: post #26

Earlier quoted context omitted.

Yeah, why is every image, heading, and paragraph on that page surrounded by scrollbars where most don't work and are not necessary?

What browser are you using? I'm not seeing that here on my devices...? We are using pretty vanilla Bootstrap.

Are your devices Apple devices by any chance?

We had a similar bug reported at work recently, and it turned out that Windows browsers will always show scrollbars but the ones running on OS X/iOS will hide them until you start scrolling.

To turn them on in OS X, go to System Preferences > General and set Show scroll bars to "Always".

Re: Post Mortem: A single whitespace character

#48

Post by jlouis »

goleksiak wrote: post #30
jlouis wrote: post #23

This proves a very important pet peeve of mine: Your modern application has a highly dynamic operating point. There is no way you can deploy a system and expect it to be static for eternity. Back in the day with low interconnectivity you could. But today it is impossible. When you build stacks on top of system for which you have no direct control, you must be able to adapt your system. This means you can't statically…

True but that doesn't bother me. Nothing is static on the web these days and everyone plays under the same rule set. Keeps things interesting...

It shouldn't bother you. It is just how moderns systems are.

Re: Post Mortem: A single whitespace character

#49

Post by zimpenfish »

michaelmior wrote: post #46
userbinator wrote: post #42

I saw it right away - "that HTTP/1.1 looks a bit farther away than it should be..." - and confirmed it by selecting the spaces. I thought it would be a bit more subtle than that... I remember working with a server that violated the HTTP spec by not accepting allowed extra spaces in headers. According to the new HTTP/1.1 RFC 7230, it should be a single space - the previous RFC didn't specify this clearly in the wordin…

That's an interesting idea. It would be useful to have a Web server where the output is just a conformance check of the request. That might be a fun project for a rainy day :)

Sounds like something that could be added to http://httpbin.org

Re: Post Mortem: A single whitespace character

#50

Post by pilif »

Likely "Cowboy" is a transparent proxy added by your mobile service provider. I had a similar thing happening a year ago when the mobile provider used by most of our barcode scanners decided to add a transparent proxy into the loop (without telling anybody).

The solution for this problem: Use SSL.

I mean: There are already many good reasons to use SSL, but whenever you need to send any kind of mission critical data over the mobile network, you practically must use SSL if you want any kind of guarantees that the data you send to the server is what actually reaches the server (and reverse).

Here's my war story from last year: http://pilif.github.io/2013/09/when-in-doubt-ssl/

Post reply on HN