Skip to content
NewA calmer, faster ZeroHour
Researchinfo

The Truth about GET and HTTP Standards, (Tue, Sep 22nd)

SANS Internet Storm Center ()1 min read2 · 2 reads
Read at isc.sans.edu
AI summary · glm-5.3Summaries by Vani AI

SANS research tests Apache, NGINX, and Python server responses to non-standard HTTP GET requests with a body, finding inconsistent handling.

A SANS Internet Storm Center blog post investigates how different web servers handle non-standard HTTP GET requests containing a message body, a scenario enabled by the new HTTP QUERY method. Testing showed that Apache 2.4.68 accepts and processes the body, while NGINX and Python's built-in HTTP server ignore the body but do not return an error. The research aims to understand server behavior and implications for developers and security.

Key facts
  • SANS research tests HTTP servers (Apache, NGINX, Python) for GET requests with a body.
  • Apache 2.4.68 accepts and processes a GET request body, returning a 200 status.
  • NGINX and Python HTTP server ignore the body but still return a response, not an error.
  • The research explores non-standard HTTP behavior and compatibility implications for developers.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
apachehttpnginxpythonresearchstandardsweb-server
Vendors
SANS Internet Storm CenterApacheNGINX
Products
ApacheNGINX
Organizations
SANS Internet Storm CenterApacheNGINX

From the original article

1 min read at isc.sans.edu

On Friday, Xavier talked about the newly introduced HTTP Query method. This new method was introduced to allow "GET" requests that include a body. The main reason for this was that GET requests typically do not contain a body.

SANS Internet Storm Center

isc.sans.edu

Read the full article at SANS Internet Storm Center

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.