Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Why HTTP/1.0? #1693

Open
catharsis71 opened this issue Feb 16, 2024 · 1 comment
Open

Why HTTP/1.0? #1693

catharsis71 opened this issue Feb 16, 2024 · 1 comment

Comments

@catharsis71
Copy link

catharsis71 commented Feb 16, 2024

Whenever an HTTP request comes in from the validator, it identifies as HTTP/1.0, i.e.

GET / HTTP/1.0

...despite containing a Host: header, an HTTP/1.1 feature that only existed as an unofficial / non-standard extension in HTTP/1.0

HTTP/1.1 went live 27 years ago so it's bizarre that the validator is still marking its requests as HTTP/1.0, while actually using HTTP/1.1 features

approximately zero legitimate traffic uses HTTP/1.0 in the current year -- besides the validator, the only other exception I know of is the ancient Lynx browser, which has generally been supplanted by more modern text-mode browsers

because HTTP/1.0 is now only used by (often malicious) bots and security scanners, it's becoming common practice to block HTTP/1.0 traffic

I implemented HTTP/1.0 blocking on my servers but with whitelisting for the validator and Lynx. Lynx is probably a lost cause but I'm hoping the validator at least could potentially be updated to mark its traffic as HTTP/1.1... or maybe even add HTTP/2 support?

@mejofi
Copy link

mejofi commented Feb 17, 2024

Apparently this is intentional, for some reason; #1592 (comment)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants