> most libraries use random order
Most libraries use an undefined order. This is not the same as random.
Akamai blocks unordered HTTP request headers
11–16 of 16 posts
Re: Akamai blocks unordered HTTP request headers
#12Is it Akamai? Or is it a single site on Akamai? CDN customers can configure their sites in a million ways. My guess is a single site that was getting DDoS'd added this as an attack signature and forgot about it.
My money, in this case, is something like Akamai Kona or Shape Security, that does bot blocking. Comparing user-agent against known header order for that specific user-agent sounds like something they would do.
Re: Akamai blocks unordered HTTP request headers
#13In the second example the author does the following: $ ACCEPT="text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" $ curl -v -H "$UA" -H "$ACCEPT" $URL |& grep ' The author fails to prefix $ACCEPT with the actual header key. It should be: $ curl -v -H "$UA" -H "Accept: $ACCEPT" $URL |& grep '
Thanks! Indeed a copy paste error, I updated the article.
Re: Akamai blocks unordered HTTP request headers
#14Is it Akamai? Or is it a single site on Akamai? CDN customers can configure their sites in a million ways. My guess is a single site that was getting DDoS'd added this as an attack signature and forgot about it.
This is just a single sites configuration.
Well, everybody knows that in statistics, a sample size of 1 gives you a 0 margin of error ;)
Re: Akamai blocks unordered HTTP request headers
#15> most libraries use random order Most libraries use an undefined order. This is not the same as random.
[deleted]
Re: Akamai blocks unordered HTTP request headers
#16I disagree with the author's title (and I see it was submitted with a different title).
This is actually a report of two bugs:
1- the standard doesn't require an order
2 - the IETF's admonition that you be liberal in what you accept.