Last updated on: 2023-03-19 09:20:47.
HTTP Compliance Sub-Violations Description¶
Sub Violation Name | Description |
---|---|
Check maximum number of cookies | The system compares the request cookies to the maximal configured number of cookies. |
Unescaped space in URL | An attacker may try to segment the URL in two or more parts by inserting an unescaped space in the middle of the URL, which is illegal by the RFC. The WAF, the server and other proxies on the way may each interpret the URL differently. |
Multiple host headers | Examines requests to ensure that they contain only a single “Host” header. |
Check maximum number of parameters | The system compares the number of parameters in the request to the maximum configured number of parameters. |
Bad host header value | Detected non RFC compliant header value. |
Check maximum number of headers | The system compares the request headers to the maximal configured number of headers. |
Unparsable request content | This violation is triggered when the system’s parser cannot parse the message. |
High ASCII characters in headers | Checks for high ASCII characters in headers (greater than 127). |
Null in request | The system issues a violation for requests with a NULL character anywhere in the request (except for a NULL in the binary part of a multipart request). |
Bad HTTP version | Enforces legal HTTP version number (only 0.9 or higher allowed). |
Content length should be a positive number | The Content-Length header value should be greater than zero; only a numeric positive number value is accepted. |
Host header contains IP address | The system verifies that the request’s host header value is not an IP address to prevent non-standard requests. |
CRLF characters before request start | Examines whether there is a CRLF character before the request method. If there is, the system issues a violation. |
No Host header in HTTP/1.1 request | Examines requests using HTTP/1.1 to see whether they contain a “Host” header. |
Bad multipart parameters parsing | The system checks the following: 1. A boundary follows immediately after request headers. 2. The parameter value matches the format: ‘name=”param_key”;rn. 3. A chunked body contains at least one CRLF. 4. A chunked body ends with CRLF. 5. Final boundary was found on multipart request. 6. There is no payload after final boundary. If one of these is false, the system issues a violation. 7. Internal batch request line has valid structure and valid method name. |
Bad multipart/form-data request parsing | When the content type of a request header contains the substring “Multipart/form-data”, the system checks whether each multipart request chunk contains the strings “Content-Disposition” and “Name”. If they do not, the system issues a violation. |
Body in GET or HEAD requests | Examines GET and HEAD requests which have a body. |
Chunked request with Content-Length header | The system checks for a Content-Length header within chunked requests. |
Several Content-Length headers | More than one content-length header is a non RFC violation. Indicates an HTTP response splitting attack. |
Header name with no header value | The system checks for a header name without a header value. |
POST request with Content-Length: 0 | Examines the content-length header of POST requests, checks if the method used is POST, and the request is not chunked. If the content-length header value is equal to 0, the system issues a violation because POST requests should usually contain a non-zero length body. |