-1

On web application someone is making invalid HTTP request containing invalid bytes.

According to RFC 3986, section 2 only ASCII characters are allowed in the HTTP Request line. However I am receiving request contains the byte sequence (in Hex) \0xC3 \0xA6, which is the UTF-8 byte sequence for 'æ' (which of course should have been percent encoded as %C3%A6). In the apache log they show up as \xc3\xa6. Nevertheless this is an invalid HTTP request, so I would like configure apache to respond with an error 400 Bad Request in this case instead of delegating the request to my Rails app. How can I do that?

BTW: My web application is a Ruby on Rails (served by Phusion Passenger mod_rails 3.0.13), but I don't think it is relevant to the question, as I am interested in configuring apache so that these requests never reaches my application.

Improve this question
2
  • Remember to figure out who's sending these invalid requests and file a bug report with them.
    – Michael Hampton
    Nov 23, 2012 at 12:12
  • It can be quite difficult to figure out who is sending those requests when all you have is an IP address. I guess the senders are some sort of hackers...
    – Jarl
    Nov 24, 2012 at 20:16

1 Answer 1

Reset to default
1

I succeeded configuring apache using mod_rewrite to respond 400 Bad request containing URLs with invalid characters.

Inspired from this tutorial I added this snippet to my apache configuration file:

# unreserved [a-zA-Z0-9\-\.\_\~]
# reserved gen-delims [\:\/\?\#\[\]\@]
# reserved sub-delims [\!\$\&\'\(\)\*\+\,\;\=]
RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ [a-zA-Z0-9\%\-\.\_\~\:\/\?\#\[\]\@\!\$\&\'\(\)\*\+\,\;\=]+(\ .+)?$
RewriteRule ^.*$  -  [redirect=400,last]

See RFC3986, section 2.2 and 2.3 for details on the valid characters.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .