HTTP.SYS rejection of request lines not terminated by CRLF (Redux)

  • Article

Ok... this is the second day in a row now where I am answering a blog comment where I think the answer already exists in one or more of my blog entries. I am now wondering how to avoid having to make redux posts because I am sure there will be a third, a fourth, etc... hey, I have no problems making posts, but I really do not want to dilute the content/post ratio.

Maybe I need to start a new RSS feed for "previously answered questions" in addition to "Web Q&A" for the first time I answer a question so that readers can discern between news vs repeats. Any thoughts on how to organize/arrange this?

Question:

Hello David,

I found your page regarding http.sys rejection of request lines article very informative. In your Q&A about workarounds, I was curious if any of those entries (or which one) fixes the CRLF problem?

Our evaluation shows that we need to find a fix to the win2003 server for a short term period because of the time, cost and risk in modifying the outdated java client that makes the call.

Thanks!

Answer:

First, let me link back to the referenced original post for the benefit of future readers. Your question would have been a good comment to the original post.

Second, I would like to point out that there is no CRLF problem to fix. HTTP.SYS is simply following the appropriate RFCs to the letter. In other words, just because an application worked before is not an indication that it was correct nor that it will continue to work. In Windows Server 2003, when we had to choose between compatibility or security, we heavily favored security (in the past, compatibility would have reigned supreme). This is just the changing of the times... the software industry is growing up.

Unfortunately, you never specified what your "problem" was, so I cannot really offer a concrete solution. If I had to guess at what your problem was... I believe that if you download the Word DOC file from the link I posted six months ago of SP1 enhancements in HTTP.SYS, you should be able to find an answer to your outdated java client. I believe it is under the section "HTTP API Parser Enhancements".

Now, if you are asking for that "SP1 change" for HTTP.SYS on Windows Server 2003 RTM, without requiring SP1, you will have to make a paid support call to Microsoft PSS to see if that backport is possible.

//David