镜像站点 · 本页由第三方 GitHub 只读镜像提供,非 GitHub 官方站点,不接受任何登录或凭据输入。前往 github.com
Skip to content

api: introduce llhttp_set_lenient_keep_alive - #94

Closed
indutny wants to merge 1 commit into
masterfrom
feature/lenient-keep-alive
Closed

indutny wants to merge 1 commit into
masterfrom
feature/lenient-keep-alive

Conversation

@indutny

@indutny indutny commented Mar 27, 2021

Copy link
Copy Markdown
Member

Extra request/response after Connection: close should be either
discarded (in loose mode), or produce error (in strict mode). However,
to support legacy client we introduce:

  • llhttp_set_lenient_keep_alive

API call to process the extra request normally. Note that it opens the
server to potential cache poisoning attacks and is dangerous to
enable in the most of situations.

@indutny

indutny commented Mar 27, 2021

Copy link
Copy Markdown
Member Author

cc @nodejs/http a review would be appreciated.

@mcollina mcollina left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm on the approach

Extra request/response after `Connection: close` should be either
discarded (in loose mode), or produce error (in strict mode). However,
to support legacy client we introduce:

* `llhttp_set_lenient_keep_alive`

API call to process the extra request normally. Note that it opens the
server to potential cache poisoning attacks and is dangerous to
enable in the most of situations.
@indutny
indutny force-pushed the feature/lenient-keep-alive branch from 5ae6adb to 6467a62 Compare March 27, 2021 19:03
@indutny

indutny commented Mar 27, 2021

Copy link
Copy Markdown
Member Author

Had to force push because of the duplicate test 🤦 Thanks @mcollina for review. Will land once CI is clear.

indutny added a commit that referenced this pull request Mar 27, 2021
Extra request/response after `Connection: close` should be either
discarded (in loose mode), or produce error (in strict mode). However,
to support legacy client we introduce:

* `llhttp_set_lenient_keep_alive`

API call to process the extra request normally. Note that it opens the
server to potential cache poisoning attacks and is dangerous to
enable in the most of situations.

PR-URL: #94
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
@indutny

indutny commented Mar 27, 2021

Copy link
Copy Markdown
Member Author

Landed in cc5adf3. Thank you! I'll do a release once #93 lands as well.

@indutny indutny closed this Mar 27, 2021
@indutny
indutny deleted the feature/lenient-keep-alive branch March 27, 2021 21:11
superstar-dev-work added a commit to superstar-dev-work/llhttp that referenced this pull request Jul 29, 2025
Extra request/response after `Connection: close` should be either
discarded (in loose mode), or produce error (in strict mode). However,
to support legacy client we introduce:

* `llhttp_set_lenient_keep_alive`

API call to process the extra request normally. Note that it opens the
server to potential cache poisoning attacks and is dangerous to
enable in the most of situations.

PR-URL: nodejs/llhttp#94
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants