Logo Dark Logo Http11Probe Probe Results Compliance Smuggling Malformed Input Glossary Add a Framework
CTRL K
    • Light

    • Dark

    • System

    GitHub
    CTRL K
      • Add a Framework
      • Compliance
      • Glossary
        • RFC Basics
        • Line Endings
          • BARE-LF-REQUEST-LINE
          • BARE-LF-HEADER
          • CR-ONLY-LINE-ENDING
          • LEADING-CRLF
        • Request Line
          • MULTI-SP-REQUEST-LINE
          • MISSING-TARGET
          • FRAGMENT-IN-TARGET
          • INVALID-VERSION
          • HTTP09-REQUEST
          • ASTERISK-WITH-GET
          • OPTIONS-STAR
          • UNKNOWN-TE-501
          • ABSOLUTE-FORM
          • METHOD-CASE
          • CONNECT-EMPTY-PORT
          • METHOD-CONNECT
          • METHOD-CONNECT-NO-PORT
          • METHOD-TRACE
          • REQUEST-LINE-TAB
          • VERSION-MISSING-MINOR
          • VERSION-LEADING-ZEROS
          • VERSION-WHITESPACE
          • CONNECT-ORIGIN-FORM
          • HTTP12-VERSION
          • TRACE-WITH-BODY
        • Header Syntax
          • SP-BEFORE-COLON
          • OBS-FOLD
          • EMPTY-HEADER-NAME
          • INVALID-HEADER-NAME
          • HEADER-NO-COLON
          • CONNECTION-CLOSE
          • WHITESPACE-BEFORE-HEADERS
          • EXPECT-UNKNOWN
          • HTTP10-DEFAULT-CLOSE
        • Host Header
          • MISSING-HOST
          • DUPLICATE-HOST
          • DUPLICATE-HOST-SAME
          • HOST-WITH-USERINFO
          • HOST-WITH-PATH
          • HOST-EMPTY-VALUE
          • HTTP10-NO-HOST
        • Body Handling
          • POST-CL-BODY
          • POST-CL-ZERO
          • POST-NO-CL-NO-TE
          • POST-CL-UNDERSEND
          • GET-WITH-CL-BODY
          • CHUNKED-BODY
          • CHUNKED-MULTI
          • CHUNKED-EMPTY
          • CHUNKED-NO-FINAL
          • CHUNKED-EXTENSION
          • CHUNKED-TRAILER-VALID
          • CHUNKED-HEX-UPPERCASE
        • Content-Length
          • CL-NON-NUMERIC
          • CL-PLUS-SIGN
        • Request Smuggling
          • CL-TE-BOTH
          • DUPLICATE-CL
          • CL-LEADING-ZEROS
          • CL-NEGATIVE
          • TE-XCHUNKED
          • TE-TRAILING-SPACE
          • TE-SP-BEFORE-COLON
          • CLTE-PIPELINE
          • TECL-PIPELINE
          • CL-TRAILING-SPACE
          • CL-EXTRA-LEADING-SP
          • TE-DOUBLE-CHUNKED
          • TE-CASE-MISMATCH
          • CL-COMMA-DIFFERENT
          • TE-NOT-FINAL-CHUNKED
          • TE-HTTP10
          • CHUNK-BARE-SEMICOLON
          • BARE-CR-HEADER-VALUE
          • CL-OCTAL
          • CHUNK-UNDERSCORE
          • TE-EMPTY-VALUE
          • TE-LEADING-COMMA
          • TE-DUPLICATE-HEADERS
          • CHUNK-EXT-LF
          • CHUNK-HEX-PREFIX
          • CHUNK-SPILL
          • CL-HEX-PREFIX
          • CHUNK-LF-TERM
          • CL-INTERNAL-SPACE
          • CHUNK-EXT-CTRL
          • CHUNK-LEADING-SP
          • CHUNK-LF-TRAILER
          • CHUNK-MISSING-TRAILING-CRLF
          • TE-IDENTITY
          • TRANSFER_ENCODING
          • CHUNK-NEGATIVE
          • CL-COMMA-SAME
          • CHUNKED-WITH-PARAMS
          • TRAILER-CL
          • EXPECT-100-CL
          • TRAILER-TE
          • TRAILER-HOST
          • HEAD-CL-BODY
          • OPTIONS-CL-BODY
          • CL-UNDERSCORE
          • CL-NEGATIVE-ZERO
          • CL-DOUBLE-ZERO
          • CL-LEADING-ZEROS-OCTAL
          • TE-OBS-FOLD
          • TE-TRAILING-COMMA
          • MULTIPLE-HOST-COMMA
          • CHUNK-BARE-CR-TERM
          • TE-TAB-BEFORE-VALUE
          • ABSOLUTE-URI-HOST-MISMATCH
          • TRAILER-CONTENT-TYPE
        • Malformed Input
          • BINARY-GARBAGE
          • LONG-URL
          • LONG-HEADER-NAME
          • LONG-HEADER-VALUE
          • LONG-METHOD
          • MANY-HEADERS
          • NUL-IN-URL
          • CONTROL-CHARS-HEADER
          • NON-ASCII-HEADER-NAME
          • NON-ASCII-URL
          • CL-OVERFLOW
          • INCOMPLETE-REQUEST
          • EMPTY-REQUEST
          • WHITESPACE-ONLY-LINE
          • NUL-IN-HEADER-VALUE
          • CHUNK-SIZE-OVERFLOW
          • H2-PREFACE
          • CHUNK-EXT-64K
          • CL-EMPTY
          • CL-TAB-BEFORE-VALUE
          • URL-BACKSLASH
          • URL-OVERLONG-UTF8
          • URL-PERCENT-NULL
          • URL-PERCENT-CRLF
          • RANGE-OVERLAPPING
          • POST-CL-HUGE-NO-BODY
        • Upgrade / WebSocket
          • UPGRADE-POST
          • UPGRADE-MISSING-CONN
          • UPGRADE-UNKNOWN
          • UPGRADE-INVALID-VER
      • Malformed Input
      • Probe Results
      • Smuggling
      • RFC Basics
      • Line Endings
        • BARE-LF-REQUEST-LINE
        • BARE-LF-HEADER
        • CR-ONLY-LINE-ENDING
        • LEADING-CRLF
      • Request Line
        • MULTI-SP-REQUEST-LINE
        • MISSING-TARGET
        • FRAGMENT-IN-TARGET
        • INVALID-VERSION
        • HTTP09-REQUEST
        • ASTERISK-WITH-GET
        • OPTIONS-STAR
        • UNKNOWN-TE-501
        • ABSOLUTE-FORM
        • METHOD-CASE
        • CONNECT-EMPTY-PORT
        • METHOD-CONNECT
        • METHOD-CONNECT-NO-PORT
        • METHOD-TRACE
        • REQUEST-LINE-TAB
        • VERSION-MISSING-MINOR
        • VERSION-LEADING-ZEROS
        • VERSION-WHITESPACE
        • CONNECT-ORIGIN-FORM
        • HTTP12-VERSION
        • TRACE-WITH-BODY
      • Header Syntax
        • SP-BEFORE-COLON
        • OBS-FOLD
        • EMPTY-HEADER-NAME
        • INVALID-HEADER-NAME
        • HEADER-NO-COLON
        • CONNECTION-CLOSE
        • WHITESPACE-BEFORE-HEADERS
        • EXPECT-UNKNOWN
        • HTTP10-DEFAULT-CLOSE
      • Host Header
        • MISSING-HOST
        • DUPLICATE-HOST
        • DUPLICATE-HOST-SAME
        • HOST-WITH-USERINFO
        • HOST-WITH-PATH
        • HOST-EMPTY-VALUE
        • HTTP10-NO-HOST
      • Body Handling
        • POST-CL-BODY
        • POST-CL-ZERO
        • POST-NO-CL-NO-TE
        • POST-CL-UNDERSEND
        • GET-WITH-CL-BODY
        • CHUNKED-BODY
        • CHUNKED-MULTI
        • CHUNKED-EMPTY
        • CHUNKED-NO-FINAL
        • CHUNKED-EXTENSION
        • CHUNKED-TRAILER-VALID
        • CHUNKED-HEX-UPPERCASE
      • Content-Length
        • CL-NON-NUMERIC
        • CL-PLUS-SIGN
      • Request Smuggling
        • CL-TE-BOTH
        • DUPLICATE-CL
        • CL-LEADING-ZEROS
        • CL-NEGATIVE
        • TE-XCHUNKED
        • TE-TRAILING-SPACE
        • TE-SP-BEFORE-COLON
        • CLTE-PIPELINE
        • TECL-PIPELINE
        • CL-TRAILING-SPACE
        • CL-EXTRA-LEADING-SP
        • TE-DOUBLE-CHUNKED
        • TE-CASE-MISMATCH
        • CL-COMMA-DIFFERENT
        • TE-NOT-FINAL-CHUNKED
        • TE-HTTP10
        • CHUNK-BARE-SEMICOLON
        • BARE-CR-HEADER-VALUE
        • CL-OCTAL
        • CHUNK-UNDERSCORE
        • TE-EMPTY-VALUE
        • TE-LEADING-COMMA
        • TE-DUPLICATE-HEADERS
        • CHUNK-EXT-LF
        • CHUNK-HEX-PREFIX
        • CHUNK-SPILL
        • CL-HEX-PREFIX
        • CHUNK-LF-TERM
        • CL-INTERNAL-SPACE
        • CHUNK-EXT-CTRL
        • CHUNK-LEADING-SP
        • CHUNK-LF-TRAILER
        • CHUNK-MISSING-TRAILING-CRLF
        • TE-IDENTITY
        • TRANSFER_ENCODING
        • CHUNK-NEGATIVE
        • CL-COMMA-SAME
        • CHUNKED-WITH-PARAMS
        • TRAILER-CL
        • EXPECT-100-CL
        • TRAILER-TE
        • TRAILER-HOST
        • HEAD-CL-BODY
        • OPTIONS-CL-BODY
        • CL-UNDERSCORE
        • CL-NEGATIVE-ZERO
        • CL-DOUBLE-ZERO
        • CL-LEADING-ZEROS-OCTAL
        • TE-OBS-FOLD
        • TE-TRAILING-COMMA
        • MULTIPLE-HOST-COMMA
        • CHUNK-BARE-CR-TERM
        • TE-TAB-BEFORE-VALUE
        • ABSOLUTE-URI-HOST-MISMATCH
        • TRAILER-CONTENT-TYPE
      • Malformed Input
        • BINARY-GARBAGE
        • LONG-URL
        • LONG-HEADER-NAME
        • LONG-HEADER-VALUE
        • LONG-METHOD
        • MANY-HEADERS
        • NUL-IN-URL
        • CONTROL-CHARS-HEADER
        • NON-ASCII-HEADER-NAME
        • NON-ASCII-URL
        • CL-OVERFLOW
        • INCOMPLETE-REQUEST
        • EMPTY-REQUEST
        • WHITESPACE-ONLY-LINE
        • NUL-IN-HEADER-VALUE
        • CHUNK-SIZE-OVERFLOW
        • H2-PREFACE
        • CHUNK-EXT-64K
        • CL-EMPTY
        • CL-TAB-BEFORE-VALUE
        • URL-BACKSLASH
        • URL-OVERLONG-UTF8
        • URL-PERCENT-NULL
        • URL-PERCENT-CRLF
        • RANGE-OVERLAPPING
        • POST-CL-HUGE-NO-BODY
      • Upgrade / WebSocket
        • UPGRADE-POST
        • UPGRADE-MISSING-CONN
        • UPGRADE-UNKNOWN
        • UPGRADE-INVALID-VER
      Edit this page on GitHub →

      Glossary

      Reference documentation for every test in Http11Probe, organized by topic. Each page explains the RFC requirement, what the test sends, what response is expected, and why it matters.

      RFC Basics
      What RFCs are, how to read requirement levels (MUST/SHOULD/MAY), and which RFCs define HTTP/1.1.
      Line Endings
      CRLF requirements, bare LF handling, and bare CR rejection per RFC 9112 Section 2.2.
      Request Line
      Request-line format, multiple spaces, missing target, fragments, HTTP version validation.
      Header Syntax
      Obs-fold, space before colon, empty names, invalid characters, missing colon.
      Host Header
      Missing Host, duplicate Host — the only tests where RFC explicitly mandates 400.
      Content-Length
      Non-numeric CL, plus sign, integer overflow, leading zeros, negative values.
      Body Handling
      Content-Length body consumption, chunked transfer encoding, incomplete bodies, chunk extensions.
      Request Smuggling
      CL+TE conflicts, TE obfuscation, pipeline injection, and why ambiguous framing is dangerous.
      Malformed Input
      Binary garbage, oversized fields, control characters, incomplete requests.
      Upgrade / WebSocket
      Protocol upgrade validation, WebSocket handshake method and version checks.