>Number: 602 >Category: general >Synopsis: HTTP/1.0 request elicits an HTTP/1.1 response >Confidential: no >Severity: serious >Priority: medium >Responsible: apache (Apache HTTP Project) >State: open >Class: sw-bug >Submitter-Id: apache >Arrival-Date: Thu May 22 00:00:02 1997 >Originator: [EMAIL PROTECTED] >Organization: apache >Release: 1.2b8 >Environment: Sun Ultra 170, Solaris 2.5 ~40patches, gcc >Description: telnet host.domain 80 GET / HTTP/1.0 <crlf> <crlf>
--> GET / HTTP/1.0 HTTP/1.1 200 OK Date: Thu, 22 May 1997 06:43:51 GMT Server: Apache/1.2b8 Last-Modified: Fri, 18 Apr 1997 00:35:13 GMT According to the 1.0 spec (http://www.w3.org/pub/WWW/Protocols/rfc1945/rfc1945) ===== HTTP/1.0 servers must: o recognize the format of the Request-Line for HTTP/0.9 and HTTP/1.0 requests; o understand any valid request in the format of HTTP/0.9 or HTTP/1.0; o respond appropriately with a message in the same protocol version used by the client. ===== in particular the last bullet point. strangely enough the 1.1 draft spec (http://www.w3.org/pub/WWW/Protocols/rfc2068/rfc2068) doesn't have this section. Maybe the draft spec breaks the 1.0 spec. Who knows? BTW we picked this up because our service monitor expected the string 1.0 so I've got to go and fix that anyway :-) Thanks, James >How-To-Repeat: telnet host.domain 80 GET / HTTP/1.0 <crlf> <crlf> --> GET / HTTP/1.0 HTTP/1.1 200 OK Date: Thu, 22 May 1997 06:43:51 GMT Server: Apache/1.2b8 Last-Modified: Fri, 18 Apr 1997 00:35:13 GMT >Fix: Yes: Clarify the spec. Make it always return the request version in the response regardless of the spec. %0 >Audit-Trail: >Unformatted:
