Re: http/1 opportunistic encryption

On Mon, Jul 13, 2015 at 10:07:01PM +1200, Amos Jeffries wrote:
> 
> If teh server is compliant with HTTP/1.1 it is expected to accept
> absolute-URI not just relative-URI.
> 
> My understanding was that :scheme was supposed to be translated into
> absolute-URI for the HTTP/1 server when the scheme does not match the
> transport protocol used to the server. If it does match then
> relative-URI was the right thing to do.
> 
> Whether reality matches that spec behaviour though is a good question.

Well, I have seen a server that when contacted over port 443 and then
queried for http://example.org/ (using absolute-URI form) would
interpret it as query for https://example.org/, and return different
data from intended (expected site front page, got some test page with
200 status).

It was running Apache with PHP (yuck) using FastCGI.


-Ilari

Received on Monday, 13 July 2015 10:28:06 UTC