Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

Is there a way to ignore HTTP 1.0 requests in IIS (7.0)? I don't see any reason to accept requests that are not HTTP 1.1.

share|improve this question
1  
I see even less reason to reject HTTP/1.0. It hasn't been marked "obsolete" yet, it's still in use by simpler (non-browser) HTTP clients, and is probably even handled by the same code as HTTP/1.1 (which was explicitly designed to remain compatible with 1.0). It would be just additional work with absolutely no gain. – grawity May 11 '12 at 16:46
Additionally, see Is HTTP/1.0 still in use? from stackoverflow – Sašo May 22 '12 at 9:27

migrated from superuser.com May 22 '12 at 9:25

1 Answer

up vote 1 down vote accepted

Step 1: download and install URL Rewrite.
Step 2: add the following to your web.config file, to the <system.webServer> section:

<rewrite>
    <rules>
        <rule name="RequestBlockingRule1" patternSyntax="Wildcard" stopProcessing="true">
            <match url="*" />
            <conditions>
                <add input="{SERVER_PROTOCOL}" pattern="HTTP/1.0" />
            </conditions>
            <action type="AbortRequest" />
        </rule>
    </rules>
</rewrite>

This will refuse all HTTP 1.0 requests with a HTTP 504 error code.

Edit: after installing URL Rewrite, you can also configure rewrite rules in IIS Manager:

enter image description here

share|improve this answer
This works perfectly! I tested using curl -v -0 http://localhost and it does indeed respond with an abort. – Mark Richman May 11 '12 at 21:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.