Pending Review
Last Updated: 25 Feb 2019 23:34 by Eric
Eric
Created on: 25 Feb 2019 23:34
Type: Bug Report
0
Fiddler HTTP protocol violation should warn on invalid header characters

The HTTP2 protocol has specific requirements about the characters that are valid in header names. If a server attempts to use one of these over a HTTP2 connection, the client will complain of a ERR_SPDY_PROTOCOL_ERROR.

This is particularly problematic because the problem will magically "disappear" when Fiddler is in use because Fiddler doesn't support HTTP2, and thus the problem characters are silently allowed by the browser using HTTP/1.1. https://twitter.com/ericlaw/status/1100175636595965957

Therefore, Fiddler's HTTP Protocol Violation feature should warn if a HTTPS response contains an illegal character in a HTTP header name or value.

Legal characters for names: abcdefghijklmnopqrstuvwxyz0123456789!#$%&'*+-.^_`|~

Legal characters for values '\t', '  ', 0x21 to 0x7E, and 0x80 to 0xFF.

https://tools.ietf.org/html/rfc7540#section-10.3


		
0 comments