HTTP is the foundational protocol of the World Wide Web, designed with a strict set of specifications that developers are expected to follow. However, real-world implementations often deviate from these standards. In this study, we not only confirm these inconsistencies but build on previous work [45] to reveal a deeper issue: the impact of network middleboxes. Using a novel framework, we demonstrate that HTTP server conformance cannot be accurately assessed in isolation, as middleboxes can alter requests and responses in transit. We conducted 47 conformance tests on 12 popular proxy implementations. Our results show that none of them are fully compliant with the relevant RFCs, and there is significant variation in their behaviors. This inconsistency stems from ambiguities in the RFCs, which fail to provide clear guidelines for these middleboxes. In some cases, the implementation choices made can lead to vulnerabilities.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

HTTP Conformance vs. Middleboxes: Identifying Where the Rules Actually Break Down

  • Ilies Benhabbour,
  • Mahmoud Attia,
  • Marc Dacier

摘要

HTTP is the foundational protocol of the World Wide Web, designed with a strict set of specifications that developers are expected to follow. However, real-world implementations often deviate from these standards. In this study, we not only confirm these inconsistencies but build on previous work [45] to reveal a deeper issue: the impact of network middleboxes. Using a novel framework, we demonstrate that HTTP server conformance cannot be accurately assessed in isolation, as middleboxes can alter requests and responses in transit. We conducted 47 conformance tests on 12 popular proxy implementations. Our results show that none of them are fully compliant with the relevant RFCs, and there is significant variation in their behaviors. This inconsistency stems from ambiguities in the RFCs, which fail to provide clear guidelines for these middleboxes. In some cases, the implementation choices made can lead to vulnerabilities.