Re:Anatomy of an Attack: How I Hacked StackOverflow (2012)
by jcranmer on Sunday July 26, 2015 @11:11PM
(#9953138)
Actually, most header fields don't allow comments. The most common one that does (User-Agent) isn't exactly necessary for processing, and is its own little world of bizarre pain.
There's a lot of historical header abuse caused by the fact that HTTP sort of shared a syntax with email MIME headers, but HTTP implementations have generally started treating such abuses as malformed. (MIME on the other hand still hasn't. It's actually quite gory.)
There's a lot of historical header abuse caused by the fact that HTTP sort of shared a syntax with email MIME headers, but HTTP implementations have generally started treating such abuses as malformed. (MIME on the other hand still hasn't. It's actually quite gory.)