2 ms·
Wouldn't the safest thing, security-wise, to fail fast on bare 0ah? As a web server, you may not know which intermediate proxies did the request traverse befor
by theamk 2y ago
Wouldn't the safest thing, security-wise, to fail fast on bare 0ah?
As a web server, you may not know which intermediate proxies did the request traverse before arriving to your port. Given that request smuggling is a thing, failing fast with no further parsing on any protocol deviations seems to be the most secure thing.
- tptacek 2y agoI mean the safest thing would be to send an RST as soon as you see a SYN for 80/tcp.
- RedShift1 2y agoWouldn't not replying at all be the safest?
- theamk 2y agoThat would have a severe downside of not letting your customers access your website. Fast-abort on bare-0ah will still be compatible with all browsers and major http clients, thus providing extra mitigations practically for free.