Request Line
Request Line
The request-line is the first line of an HTTP request: method SP request-target SP HTTP-version CRLF. RFC 9112 Section 3 defines its grammar strictly. Malformed request-lines are a common vector for parser confusion.
The Rule
“Recipients of an invalid request-line SHOULD respond with either a 400 (Bad Request) error or a 301 (Moved Permanently) redirect with the request-target properly encoded.” — RFC 9112 Section 3
Note this is a SHOULD, not a MUST. The RFC recommends 400 but does not mandate it — closing the connection is also acceptable.
Tests
Multiple spaces between method, target, and version.
Request-line with no request-target.
Fragment identifier (#) in request-target.
Unrecognized HTTP version string.
HTTP/0.9 style request with no version.
Asterisk-form (*) with non-OPTIONS method.
OPTIONS * — valid asterisk-form request.
Unknown Transfer-Encoding without CL.
CONNECT with empty port in authority-form.
CONNECT to an origin server must be rejected.
CONNECT without port in authority-form.