Re: CRLF requirement from Willy Tarreau on 2014-06-30 (ietf-http-wg@w3.org from April to June 2014)

From: Willy Tarreau <w@1wt.eu>
Date: Mon, 30 Jun 2014 13:35:23 +0200
To: Anne van Kesteren <annevk@annevk.nl>
Cc: ietf-http-wg@w3.org
Message-ID: <20140630113523.GD9519@1wt.eu>

Hi Anne,

On Mon, Jun 30, 2014 at 01:23:50PM +0200, Anne van Kesteren wrote:
> Why does https://tools.ietf.org/html/rfc7230 still require CRLF while
> most implementations handle either CR or LF fine? As far as I can tell
> line parsing in HTTP is interoperable with text/plain, text/html,
> text/css, etc. It's newline = CR / LF / CRLF.

Please take a look at 3.5. "Message Parsing Robustness" :

  "Although the line terminator for the start-line and header fields is
   the sequence CRLF, a recipient MAY recognize a single LF as a line
   terminator and ignore any preceding CR."

Also, I've seen some servers on some sites which do not accept plain LFs
(probably some WAFs installed there), and my experience with plain CR has
never been good, at least LF was needed on all servers tested.

Regards,
Willy

Received on Monday, 30 June 2014 11:35:51 UTC