What does "deceptive request routing" mean in the new HTTP spec (RFC 7231)? -


in rfc 2616, 400 response code syntax errors.

the request not understood server due malformed syntax. client should not repeat request without modifications.

rfc 7231 broadens applicability of 400. spec gives few other examples of client errors, i'm not sure mean.

the 400 (bad request) status code indicates server cannot or not process request due perceived client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).

in particular, constitute "deceptive request routing"?

as 1 example, relevant cdn. see rfc 3568.

section 4.1.2 stands out me:

this technique involves task of using http [4] such cookie, language, , user-agent, in order select surrogate. in [20] examples of using technique provided.

the relevancy of cited example ("deceptive request routing") comes in when system relies on information including custom http headers decision making. when such header absent, stale, incorrect, or otherwise not processable. as general rule, malformed or "wrong" coming public internet can safely assumed malicious (or "deceptive").


another example: man-in-the-middles uplink , hijacks session cookie. tries access site cookie, of sudden system sees requests same token coming 2 different ip addresses.


Comments

Popular posts from this blog

javascript - Jquery show_hide, what to add in order to make the page scroll to the bottom of the hidden field once button is clicked -

javascript - Highcharts multi-color line -

javascript - Enter key does not work in search box -