News for hackers. Stuff that matters.

A comment on Defending a website with Zip bombs. Parent comment

Re:Defending a website with Zip bombs by jwilk on Thursday July 06, 2017 @06:00AM (#14709212)
Most (all?) user-agents don't set the TE header (which specifies the transfer encodings the UA is willing to accept), so I doubt they would bother to decode unsolicited "Transfer-Encoding: gzip".
[ Parent | on HN ]
Re:Defending a website with Zip bombs by mnarayan01 on Thursday July 06, 2017 @09:57AM (#14710424)
The Accept-Encoding header is used to specify the acceptable transfer encodings. Certainly all browsers set it, and most "advanced" frameworks will at least handle the common values of Transfer-Encoding regardless; a "malicious" crawler will almost certainly have to, as plenty of sites use Accept-Encoding along with User-Agent to block undesirable bots.
[ Parent | on HN ]
Re:Defending a website with Zip bombs by colanderman on Thursday July 06, 2017 @11:30AM (#14711132)
No, Accept-Encoding pairs with Content-Encoding, not Transfer-Encoding (which is controlled by TE as GP indicated). [1] [2]

[1] https://tools.ietf.org/html/rfc7231#section-5.3.4

[2] https://tools.ietf.org/html/rfc7230#section-4.3

[ Parent | on HN ]
Re:Defending a website with Zip bombs by mnarayan01 on Thursday July 06, 2017 @01:00PM (#14711859)
Bah I can't read...you two are correct.
[ Parent | on HN ]
Re:Defending a website with Zip bombs by colanderman on Thursday July 06, 2017 @09:54AM (#14710412)
Good point, I didn't realize that.
[ Parent | on HN ]