On web application someone is making invalid HTTP request containing invalid bytes.

According to RFC 3986, section 2 only ASCII characters are allowed in the HTTP Request line. However I am receiving request contains the byte sequence (in Hex) \0xC3 \0xA6, which is the UTF-8 byte sequence for 'æ' (which of course should have been percent encoded as %C3%A6). In the apache log they show up as \xc3\xa6. Nevertheless this is an invalid HTTP request, so I would like configure apache to respond with an error 400 Bad Request in this case instead of delegating the request to my Rails app. How can I do that?

BTW: My web application is a Ruby on Rails (served by Phusion Passenger mod_rails 3.0.13), but I don't think it is relevant to the question, as I am interested in configuring apache so that these requests never reaches my application.

  • Remember to figure out who's sending these invalid requests and file a bug report with them. Nov 23, 2012 at 12:12
  • It can be quite difficult to figure out who is sending those requests when all you have is an IP address. I guess the senders are some sort of hackers...
    – Jarl
    Nov 24, 2012 at 20:16

1 Answer 1


I succeeded configuring apache using mod_rewrite to respond 400 Bad request containing URLs with invalid characters.

Inspired from this tutorial I added this snippet to my apache configuration file:

# unreserved [a-zA-Z0-9\-\.\_\~]
# reserved gen-delims [\:\/\?\#\[\]\@]
# reserved sub-delims [\!\$\&\'\(\)\*\+\,\;\=]
RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ [a-zA-Z0-9\%\-\.\_\~\:\/\?\#\[\]\@\!\$\&\'\(\)\*\+\,\;\=]+(\ .+)?$
RewriteRule ^.*$  -  [redirect=400,last]

See RFC3986, section 2.2 and 2.3 for details on the valid characters.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .