Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On web application someone is making invalid HTTP request containing invalid bytes.

According to RFC 3986, section 2 only ASCII characters are allowed in the HTTP Request line. However I am receiving request contains the byte sequence (in Hex) \0xC3 \0xA6, which is the UTF-8 byte sequence for 'æ' (which of course should have been percent encoded as %C3%A6). In the apache log they show up as \xc3\xa6. Nevertheless this is an invalid HTTP request, so I would like configure apache to respond with an error 400 Bad Request in this case instead of delegating the request to my Rails app. How can I do that?

BTW: My web application is a Ruby on Rails (served by Phusion Passenger mod_rails 3.0.13), but I don't think it is relevant to the question, as I am interested in configuring apache so that these requests never reaches my application.

share|improve this question
    
Remember to figure out who's sending these invalid requests and file a bug report with them. –  Michael Hampton Nov 23 '12 at 12:12
    
It can be quite difficult to figure out who is sending those requests when all you have is an IP address. I guess the senders are some sort of hackers... –  Jarl Nov 24 '12 at 20:16
add comment

migrated from stackoverflow.com Nov 23 '12 at 12:05

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 1 down vote accepted

I succeeded configuring apache using mod_rewrite to respond 400 Bad request containing URLs with invalid characters.

Inspired from this tutorial I added this snippet to my apache configuration file:

# unreserved [a-zA-Z0-9\-\.\_\~]
# reserved gen-delims [\:\/\?\#\[\]\@]
# reserved sub-delims [\!\$\&\'\(\)\*\+\,\;\=]
RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ [a-zA-Z0-9\%\-\.\_\~\:\/\?\#\[\]\@\!\$\&\'\(\)\*\+\,\;\=]+(\ .+)?$
RewriteRule ^.*$  -  [redirect=400,last]

See RFC3986, section 2.2 and 2.3 for details on the valid characters.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.