VERSION-CASE

Test IDCOMP-VERSION-CASE
CategoryCompliance
ScoredYes
RFCRFC 9112 §2.3
RFC LevelMUST
Expected400 or connection close

What it sends

A GET request with lowercase http/1.1 instead of HTTP/1.1.

GET / http/1.1\r\n
Host: localhost:8080\r\n
\r\n

What the RFC says

“HTTP-version is case-sensitive.” — RFC 9112 §2.3

“HTTP-version = HTTP-name ‘/’ DIGIT ‘.’ DIGIT” — RFC 9112 §2.3

“HTTP-name = %x48.54.54.50 ; ‘HTTP’” — RFC 9112 §2.3

The ABNF specifies the exact octets H, T, T, P — only uppercase matches.

Why it matters

A server that accepts http/1.1 as valid is performing case-insensitive comparison on the HTTP version, which violates the protocol specification. While unlikely to cause security issues on its own, lenient parsing of protocol-level tokens can mask deeper parsing inconsistencies that smuggling attacks exploit.

Verdicts

  • Pass — Server rejects with 400 or closes the connection
  • Fail — Server accepts the request

Sources