rejetto forum

HTTP Header Size Problem

User21 · 6 · 8438

0 Members and 1 Guest are viewing this topic.

Offline User21

  • Occasional poster
  • *
    • Posts: 2
    • View Profile
Hallo Forum,

so far I used HFS version 2.2f as a simple binary file server.
If HFS got an HTTP-Request /GET/update.bin, the HTTP-Response Header was

HTTP / 1.1 200 OK
Content-Type: application / octet-stream
Content Length: 75470
Accept-Ranges: bytes
Content-Disposition: attachment; filename = "update.bin";
Last-Modified: Fri, 08 Sep 2017 09:39:43 GMT


For security reasons I wanted to update HFS to the current version.
But version 2.3k now answers with:

HTTP / 1.1 200 OK
Content-Type: application / octet-stream
Content Length: 75470
Accept-Ranges: bytes
Set-Cookie: HFS_SID_ = 0.818251500837505; path = /; HttpOnly
ETag: B0772E23A80C880E27639CEF62C2F1A1
Last-Modified: Fri, 08 Sep 2017 09:39:43 GMT
Content-Disposition: attachment; filename = "update.bin";


That's nearly 100 bytes more information which my (embedded) system does not need and unfortunately creates a buffer overflow because I only provided a 256 bytes buffer for HTTP-Response. The whole HTTP header will be dropped off immediately.

Is there an easy way to turn off Set-Cookie and ETag?

And if not, ist there an security reason not to use 2.2f any longer?

Regards,
Lothar


« Last Edit: August 14, 2018, 01:14:57 PM by User21 »


Offline rejetto

  • Administrator
  • Tireless poster
  • *****
    • Posts: 13520
    • View Profile
current version doesn't allow you to remove such headers.
with next version 2.3m you will be able to program this event
Code: [Select]
[+download]
{.remove header|ETag.}
{.remove header|Set-cookie.}

I'm not sure if security problems that have been fixed in time affect 2.2f. Surely most don't. You should make a search yourself, sorry.


Offline User21

  • Occasional poster
  • *
    • Posts: 2
    • View Profile
New version 2.3m has been installed and

Code: [Select]
[+download]
{.remove header|ETag.}
{.remove header|Set-cookie.}

has been added to hfs.events.

It works perfectly now. :D

Thanks a lot for this very fast fix.

Regards,
Lothar
« Last Edit: August 29, 2018, 06:22:13 AM by User21 »


Offline LeoNeeson

  • Tireless poster
  • ****
    • Posts: 856
  • Status: On hiatus       (sporadically here)
    • View Profile
    • twitter.com/LeoNeeson
Possible bug?... ???

This works:
Quote
[+download]
{.remove header|ETag.}
{.remove header|Set-cookie.}

This partially work:
Quote
[+request]
{.remove header|ETag.}
{.remove header|Set-cookie.}

It seems the "remove header" works perfectly on [+download] but on [+request] only remove the header "Set-cookie" but NOT the ETag. I haven't tested using another "Events" (perhaps this is a small detail to fix on the build).
HFS in Spanish (HFS en Español) / How to compile HFS (Tutorial)
» Currently taking a break, until HFS v2.4 get his stable version.


Offline Mars

  • Operator
  • Tireless poster
  • *****
    • Posts: 2061
    • View Profile
all the headers are not added in one block but at various stages of the execution, so it can happen that the one we want to withdraw at a given moment does not exist yet and that it appears at the end, the phenomenon is even more possible since some macros are not directly usable (especially in events)
« Last Edit: August 28, 2018, 09:26:33 PM by Mars »


Offline LeoNeeson

  • Tireless poster
  • ****
    • Posts: 856
  • Status: On hiatus       (sporadically here)
    • View Profile
    • twitter.com/LeoNeeson
all the headers are not added in one block but at various stages of the execution, so it can happen that the one we want to withdraw at a given moment does not exist yet and that it appears at the end, the phenomenon is even more possible since some macros are not directly usable (especially in events)
That's right, I do understand, but from my point of view, I think [+request] is run first before anything (even before [+download]), so, perhaps the code to remove headers should be taken on consideration since the first initial request section. Correct me if I'm wrong.

You can try to reproduce the error using this or these 'HFS.Events'. More information about view HTTP Headers here.
HFS in Spanish (HFS en Español) / How to compile HFS (Tutorial)
» Currently taking a break, until HFS v2.4 get his stable version.