Re: Message delimiting security issues

ons 2007-01-17 klockan 11:22 -0800 skrev Travis Snoozy:

> struck between what's secure and what's utilitarian. However, being _blatently_
> malformed (e.g., two of any field that's not a #list) is always grounds for
> immediate rejection. Fuzzy repair work, in this case, is a Very Bad Thing.

The issue being that most implementations won't check this unless it's
required. Simply chewing what they get. And depending on the
implementation this results in the implementation reading either the
first occurrence or the last of the headers.

Also with the extensibility of HTTP is hard to put as a general
requirement that recipients should check how many times a non-list
header is seen.

Regards
Henrik