- From: Dave Kristol <dmk@bell-labs.com>
- Date: Tue, 26 May 1998 14:41:25 -0400
- To: Ross Patterson <Ross_Patterson@ns.reston.vmd.sterling.com>
- Cc: http-wg@cuckoo.hpl.hp.com
Ross Patterson wrote: > [...] > The second point to make is that an empty REFERER: header is illegal. > The BNF in section 14.36 reads: > > "Referer = "Referer" ":" ( absoluteURI | relativeURI )" > > There is a required value. Surely the RFC can't make a normative > statement expecting a compliant implementation to ignore mal-formed > headers - that way would lie madness and miscommunication. I don't think it's so crazy for an implementation to treat a malformed header as though it were simply missing. If the header is required for proper interpretation of the request, then the request will fail. If the header is just optional fluff (User-Agent, Referer), then the actually or implied missing header can be ignored, no harm done. I agree that the empty Referer header violates the specified syntax. The question is, what should the recipient do about it? A server could parse all headers strictly according to the specified syntax and return a 400 Bad Request response if it sees an error. Or, it could adopt the more common tolerant Internet behavior and ignore the malformed header. I seem to have encountered, for the first time of which I'm aware, an example of the former, and it surprised me. Dave Kristol
Received on Tuesday, 26 May 1998 11:44:03 UTC