Skip to content

Ensure compliance according to the URI spec #122

@Kaliumhexacyanoferrat

Description

@Kaliumhexacyanoferrat

RFC 9112 for HTTP/1.1 refers to RFC 3986 for the path segment of the HTTP header:

The rules below are defined in [URI]:

absolute-URI = <absolute-URI, see [URI], Section 4.3>
authority = <authority, see [URI], Section 3.2>
uri-host = <host, see [URI], Section 3.2.2>
port = <port, see [URI], Section 3.2.3>
query = <query, see [URI], Section 3.4>

Therefore we should check whether the web framework is compliant to RFC 3986 for URI handling. This includes cases such as:

  • Allowing to access percent encoded resources (such as %2C for a /)
  • Sending an empty path (so instead of /)
  • Sending absolute uris (such as GET https://web.site/path/)
  • Accepting an asterisk (such as OPTIONS *)
  • Allowing path segments (such as GET /a/b/../c which has to be normalized to /a/c)
  • Empty query (/search?)
  • ...

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions