News for hackers. Stuff that matters.
Re:New differential fuzzing tool reveals novel HTTP request ... by pid-1 on Thursday November 25, 2021 @03:14PM (#29344600)
Why is HTTP so complex? The base use case (hypermedia request-response) sounds really simple.
Re:New differential fuzzing tool reveals novel HTTP request ... by dtech on Thursday November 25, 2021 @05:34PM (#29345609)
HTTP 1.1 is an old protocol, over time new requirements made modifications necessary, some things fell out of use, and some changes turned out to be mistakes. That it's text-based without using doesn't help

The basis is simple, but then add Cookies, HTTPS, Authentication, Redirecting, Host headers, caching, chunked encoding, WebDAV, CORS, etc etc. All justifiable but all adding complexity.

Re:New differential fuzzing tool reveals novel HTTP request ... by bawolff on Thursday November 25, 2021 @03:50PM (#29344863)
Http/0.9 is pretty simple, but for a fast web we needmore complexity.
Re:New differential fuzzing tool reveals novel HTTP request ... by Joker_vD on Thursday November 25, 2021 @03:59PM (#29344943)
More parsing and data processing = faster web. It all makes sense, really!

Joking aside, some "features" in HTTP/1.1 are really questionable. Trailing headers? 1xx responses? Comments in chunked encoding? The headers that proxies must cut out in addition to those specified in "Connection" header except the complete list of those is specified nowhere? The methods that prohibit the request/response to have a body but again, the full list is nowhere to be found?

All these features have justifications but the end result is a protocol with rather baroque syntax and semantics.

P.S. By the way, the HTTP/1.1 specs allow a GET request to have a body in chunked encoding — guess how many existing servers support that.

Re:New differential fuzzing tool reveals novel HTTP request ... by xxpor on Thursday November 25, 2021 @03:26PM (#29344701)
Nearly all L7 protocols and their parsers are complex. HTTP is kind of simple, relatively speaking.