The Truth about GET and HTTP Standards, (Tue, Sep 22nd)
SANS research tests Apache, NGINX, and Python server responses to non-standard HTTP GET requests with a body, finding inconsistent handling.
A SANS Internet Storm Center blog post investigates how different web servers handle non-standard HTTP GET requests containing a message body, a scenario enabled by the new HTTP QUERY method. Testing showed that Apache 2.4.68 accepts and processes the body, while NGINX and Python's built-in HTTP server ignore the body but do not return an error. The research aims to understand server behavior and implications for developers and security.
- SANS research tests HTTP servers (Apache, NGINX, Python) for GET requests with a body.
- Apache 2.4.68 accepts and processes a GET request body, returning a 200 status.
- NGINX and Python HTTP server ignore the body but still return a response, not an error.
- The research explores non-standard HTTP behavior and compatibility implications for developers.
Full article281 words · extracted from isc.sans.edu · click to collapse
On Friday, Xavier talked about the newly introduced HTTP Query method. This new method was introduced to allow "GET" requests that include a body. The main reason for this was that GET requests typically do not contain a body. But what if they do?
I did a quick check of a couple of common web servers I had handy, to see what would happen:
Apache
For this test, I ran Apache 2.4.68 on a Mac. It happily accepted a body with a GET request:
% nc -c localhost 8080 GET /cgi-bin/test-cgi HTTP/1.1 Host: localhost Content-Length: 6 TEST HTTP/1.1 200 OK Date: Tue, 22 Sep 2026 14:39:17 GMT Server: Apache/2.4.68 (Unix) Transfer-Encoding: chunked Content-Type: text/plain; charset=iso-8859-1 18a CGI/1.0 test script report: [some details omited] CONTENT_LENGTH = 6 BODY = TEST
The data was collected using a slightly modified version of the standard "test-cgi" script. The body was received just fine, and a 200 status was returned.
NGINX
% nc -c 10.128.1.11 80
GET /cgi-bin/test-cgi HTTP/1.1
Host: localhost
Content-Length: 6
TESTHTTP/1.1 301 Moved Permanently
Server: nginx
The request still did not trigger an error. But the body was ignored. The server started sending the response as soon as it received the headers. The body was ignored.
Python
A simple Python web server (python -m http.server 8000) appears to behave just like NGINX. The body is ignored, but a response is sent back, and the status code is 200.
Do you have any web servers to test to see how they respond to a GET request with a body?
--
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|
Text extracted automatically; images, tables and formatting may be missing. Original: https://isc.sans.edu/diary/rss/33358