HTTP 1.0 has security weakness related to session hijacking. Is there a way to disable it by using the mod_rewrite module?

  • 1
    What weakness are you talking about? The premise seems flawed, and it makes very little sense to forbid "HTTP/1.0" requests.
    – Ángel
    Commented Nov 29, 2017 at 2:22

2 Answers 2

  1. Ensure to load mod_rewrite module in httpd.conf file
  2. Enable RewriteEngine directive as following and add Rewrite condition to allow only HTTP 1.1

    RewriteEngine On
    RewriteCond %{THE_REQUEST} !HTTP/1.1$
    RewriteRule .* - [F]
  • 6
    This woud also forbid HTTP/2... Commented Nov 28, 2017 at 13:54

You may try this mod_rewrite, this worked for me. Here the server would try to respond with a 403-Forbidden response code.

RewriteCond %{THE_REQUEST} HTTP/1\.0$
RewriteCond %{REQUEST_URI} !^/path-to-your-custom-403-error-page\.html$
RewriteRule .? - [F]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .