You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@httpd.apache.org by Florent Georges <li...@fgeorges.org> on 2009/03/09 12:57:32 UTC

[users@httpd] Validating HTTP requests

  Hi,

  I am looking for an HTTPD module.  I've made a few searches
within the repository but didn't find anything.  So just in
case I missed something...

  I look for a tool to validate HTTP requests.  The perfect
tool would install in the HTTP server and respond to HTTP
requests with a validation report (as text, or XML, or HTML,
or whatever.)  By validating, I mean validate the request
against the HTTP grammar, checking that required info are
there, that "\r\n" are used and not just "\n", checking that
multipart requests are well-formed (Content-Length are
corrects, so are boundaries, etc.,) the different headers,
etc.

  Do you know something corresponding (at least vaguely) to
that description?  If you know any library that does that job
(instead of an HTTPD module,) I am also interested, I can
write a CGI script or anything else to plug it.

  Regards,

-- 
Florent Georges
http://www.fgeorges.org/

























      

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Validating HTTP requests

Posted by Ivars Strazdiņš <iv...@gmail.com>.

Florent Georges wrote:
> Ivars Strazdiņš wrote:
>
>   Ivars,
>
>   
>> mod_security ?
>> http://www.modsecurity.org/
>>     
>
>   Thank you.  But if I am right, this allows one to plug its own validation rules in Apache (or use built-in rules from ModSecurity but those are oriented to the application scope: injection detection, authentication etc.)  I don't see how it could be use in my case, but I maybe have missed something?  Did you think about a particular way to using it in that context?
>   
No, not really. It was a gross assumption that you need a module which 
verifies input and allows you to write your own rules.
BR,
Ivars

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Validating HTTP requests

Posted by Florent Georges <li...@fgeorges.org>.

Ivars Strazdiņš wrote:

  Ivars,

> mod_security ?
> http://www.modsecurity.org/

  Thank you.  But if I am right, this allows one to plug its own validation rules in Apache (or use built-in rules from ModSecurity but those are oriented to the application scope: injection detection, authentication etc.)  I don't see how it could be use in my case, but I maybe have missed something?  Did you think about a particular way to using it in that context?

  Regards,

-- 
Florent Georges
http://www.fgeorges.org/

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Validating HTTP requests

Posted by Ivars Strazdiņš <iv...@gmail.com>.

Florent Georges wrote:
>   I am looking for an HTTPD module.  I've made a few searches
> within the repository but didn't find anything.  So just in
> case I missed something...
>
> ...
>   
mod_security ?
http://www.modsecurity.org/

Ivars

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Validating HTTP requests

Posted by Frank Gingras <fr...@gmail.com>.

Mohil,

Please disregard this troll. He has been known to infect every new 
thread in this mailing list.

Frank.

Flowering Weeds wrote:
>  
>
>   
>> Subject: Re: [users@httpd] Validating HTTP requests
>>
>>
>> Brian Mearns wrote:
>>
>>     
>>> Sorry, don't know of anything in particular, but it seems
>>> to me that Apache itself would necessarily be doing some
>>> amount of validation on the in coming requests.
>>>       
>> Yes of course :-). But 1/ I'd like the validation to be as strict as possible (as you said, I expect Apache to be a bit lenient with its clients) and 2/ I'd like to have the report with useful information in case of failure to be sent in response to the request, instead of having to give the client the right to dig into the logs on the server.
>>
>> Thanks for your response, regards,
>>
>>     
>
>
>  
>
> One hates to say it but
>
>  
>
> All current Windows systems have an object that does this
>
>  
>
> http.sys
>
>  
>
> Http.sys can be used by an application using HTTP (if one wishes to use http.sys), and all these apps can use the same IP / Port (or not).
>
>  
>
> One can read the http.sys error log with Log Parser like this
>
>  
>
> LogParser.exe "SELECT * FROM HTTPERR"
>
>  
>
> I will soon have an Apache post where one will using the Windows .NET automation toool,
>
> PowerShell (like sed, bash, and perl but dealing with complete objects instead of only text), 
>
> to check the http.sys error log. One will be able to compare these http.sys's error times to 
>
> the times within the Apache access log and the Apache error log. This will also demo "finding 
>
> same time" log actions for possible trouble checking of Apache.
>
>  
>
>  
>
> _________________________________________________________________
> Hotmail® is up to 70% faster. Now good news travels really fast. 
> http://windowslive.com/online/hotmail?ocid=TXT_TAGLM_WL_HM_70faster_032009
>   



---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org