Re: [hybi] #1: HTTP Compliance

[Julian Reschke <[e-mail]>]

On 15.08.2010 15:06, Shelby Moore wrote:
 > ...
> For as long as servers are free to have variable
> interpretations/implementations of HTTP (within the broad constrainsts of
> the spec), then HTTP request smuggling will exist.  And since I understand
> that variable interpretationsinterpretations/implementations is critical
> to HTTP robustness, then I conclude that "security" at the *transparent*
> proxy is an oxymoron.  A *transparent* proxy should never be used for
 > ...

Request smuggling happens when an HTTP message is invalid (for instance, 
because of duplicate Content-Length headers). There is no requirement 
for "robustness" in the HTTP spec related to this (if you disagree, 
please be more specific...).

As a matter of fact, HTTPbis is going to require that recipients  reject 
messages with this kind of problem; see 
<http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p1-messaging-11.html#rfc.section.3.3.p.7>.

Best regards, Julian