A few years back I was building a web server from scratch for my own quirky needs (using, of all things, C and Scheme). It required understanding the HTTP prot

A few years back I was building a web server from scratch for my own quirky needs (using, of all things, C and Scheme). It required understanding the HTTP protocol, and I agree the RFCs are not all that hard to read and learning the details in order to apply them. However what I eventually found out is that the HTTP "rules" were not faithfully followed by many implementations. For example, extra care taken to make sure HTTP headers were correctly parsed just caused headaches. The trouble was that headers received from many origins were "malformed" despite specs saying what a header "MUST" contain or what characters are not allowed. I know servers are supposed to be "tolerant" of non-compliant clients (and vice-versa), and realistically there's little choice but to go along with "loose" compliance. I've often wondered to what extent that reality contributes to less than optimum security that's so often been an issue.