On web application someone is making invalid HTTP request containing invalid bytes.

According to RFC 3986, section 2 only ASCII characters are allowed in the HTTP Request line. However I am receiving request contains the byte sequence (in Hex) \0xC3 \0xA6, which is the UTF-8 byte sequence for 'æ' (which of course should have been percent encoded as %C3%A6). In the apache log they show up as \xc3\xa6. Nevertheless this is an invalid HTTP request, so I would like configure apache to respond with an error 400 Bad Request in this case instead of delegating the request to my Rails app. How can I do that?

BTW: My web application is a Ruby on Rails (served by Phusion Passenger mod_rails 3.0.13), but I don't think it is relevant to the question, as I am interested in configuring apache so that these requests never reaches my application.

migrated from stackoverflow.com Nov 23 '12 at 12:05

This question came from our site for professional and enthusiast programmers.

  • Remember to figure out who's sending these invalid requests and file a bug report with them. – Michael Hampton Nov 23 '12 at 12:12
  • It can be quite difficult to figure out who is sending those requests when all you have is an IP address. I guess the senders are some sort of hackers... – Jarl Nov 24 '12 at 20:16

I succeeded configuring apache using mod_rewrite to respond 400 Bad request containing URLs with invalid characters.

Inspired from this tutorial I added this snippet to my apache configuration file:

# unreserved [a-zA-Z0-9\-\.\_\~]
# reserved gen-delims [\:\/\?\#\[\]\@]
# reserved sub-delims [\!\$\&\'\(\)\*\+\,\;\=]
RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ [a-zA-Z0-9\%\-\.\_\~\:\/\?\#\[\]\@\!\$\&\'\(\)\*\+\,\;\=]+(\ .+)?$
RewriteRule ^.*$  -  [redirect=400,last]

See RFC3986, section 2.2 and 2.3 for details on the valid characters.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.