Repository navigation
HTTP connection prematurely closed when unescaped space present in query string #13407
Description
- Version: v6.10.3, v8.0.0
- Platform: Darwin emerald.local 16.6.0 Darwin Kernel Version 16.6.0: Fri Apr 14 16:21:16 PDT 2017; root:xnu-3789.60.24~6/RELEASE_X86_64 x86_64
- Subsystem: http
When handling an HTTP request with an unescaped space in the query string, the connection is prematurely closed.
Example
const http = require('http');
http.createServer((req, res) => {
res.writeHead(200);
res.write('ok');
res.end();
}).listen(8080);$ curl -v 'http://localhost:8080?foo=bar &baz=bip'
> GET /?foo=bar &baz=bip HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.51.0
> Accept: */*
>
curl: (52) Empty reply from server
Activity
alexkwolfe commentedon Jun 2, 2017
Using this bug it is possible to craft a denial of service attack when running Node behind an NGINX reverse proxy. NGINX treats the closed connection as though the server has gone offline. When requests crafted in this way are sent in rapid succession, NGINX may start returning HTTP 504 to all callers because there are "no live upstreams" left to service the request.
The preferred behavior, in my opinion, would be to return an HTTP 400 instead of closing the connection. This seems to be the prevailing treatment on the interwebs.
bnoordhuis commentedon Jun 2, 2017
Node.js won't do it for you but you can send a 400 response if you listen for the 'clientError' event on the server instance. There is an example in the documentation.
alexkwolfe commentedon Jun 2, 2017
Oh nice! Thanks!
alexkwolfe commentedon Jun 2, 2017
Is this is the correct way to handle this case? Or is it worth leaving this issue open?
bnoordhuis commentedon Jun 3, 2017
We're currently discussing whether to change the default behavior from 'close connection' to 'send 400 response and close connection'. This issue can stay open until that discussion is resolved.
apapirovski commentedon Apr 12, 2018
This was resolved in #15324