Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Peter Kreuser
Mark, maybe this getting offtopic. > Am 07.01.2020 um 18:58 schrieb Mark Thomas : > > On 07/01/2020 16:22, Christopher Schultz wrote: > > > >> Since the Host header seems to be special in this regard (i.e. there >> is no prohibition against multiple Accept headers), might we be >> willing to

Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Mark Thomas
On 07/01/2020 16:22, Christopher Schultz wrote: > Since the Host header seems to be special in this regard (i.e. there > is no prohibition against multiple Accept headers), might we be > willing to interpret the spec in a slightly less strict manner? > > " > A server MUST respond with a 400 (Ba

Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Peter Kreuser
Chris (and Mark), > Am 07.01.2020 um 17:22 schrieb Christopher Schultz > : > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Mark, > >> On 1/7/20 4:36 AM, Mark Thomas wrote: >>> On 07/01/2020 07:10, Dennis Rech wrote: >>> POST /foo HTTP/1.1 Host: foo.com POST /foo HTTP/1.1 Host:

Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 1/7/20 4:36 AM, Mark Thomas wrote: > On 07/01/2020 07:10, Dennis Rech wrote: >> POST /foo HTTP/1.1 Host: foo.com POST /foo HTTP/1.1 Host: >> foo.com Content-[stuff] [...] > > First two lines are OK. > > The third line is going to be treat

Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Dennis Rech
Dear Mark, thanks a lot for your effort and your feedback. Am 07.01.20 um 10:36 schrieb Mark Thomas: On 07/01/2020 07:10, Dennis Rech wrote: POST /foo HTTP/1.1 Host: foo.com POST /foo HTTP/1.1 Host: foo.com Content-[stuff] [...] First two lines are OK. The third line is going to be treated

Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread Mark Thomas
On 07/01/2020 07:10, Dennis Rech wrote: > POST /foo HTTP/1.1 > Host: foo.com > POST /foo HTTP/1.1 > Host: foo.com > Content-[stuff] [...] First two lines are OK. The third line is going to be treated as an HTTP header. It is invalid and Tomcat will reject it with a 400 response but you can tell T

Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-07 Thread logo
Dennis, Am 07.01.2020 um 08:10 schrieb Dennis Rech : Hi Christopher, Am 06.01.20 um 17:39 schrieb Christopher Schultz: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Dennia, On 1/6/20 07:09, Dennis Rech wrote: we have an application where HTTP clients have a kind of unclean way of submi

Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-06 Thread Dennis Rech
Hi Christopher, Am 06.01.20 um 17:39 schrieb Christopher Schultz: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Dennia, On 1/6/20 07:09, Dennis Rech wrote: we have an application where HTTP clients have a kind of unclean way of submitting HTTP POST requests to our tomcat server for data upl

Re: Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Dennia, On 1/6/20 07:09, Dennis Rech wrote: > we have an application where HTTP clients have a kind of unclean > way of submitting HTTP POST requests to our tomcat server for data > upload: The |POST| and |Host: xxx| part appears twice in the > requ

Ignore duplicate HTTP headers in Tomcat 8.5.50-0+deb9u1

2020-01-06 Thread Dennis Rech
Hi and happy new year, we have an application where HTTP clients have a kind of unclean way of submitting HTTP POST requests to our tomcat server for data upload: The |POST| and |Host: xxx| part appears twice in the request. Until now this didn't cause any problems with tomcat, but since the