HTTP Conformance vs. Middleboxes: Identifying Where the Rules Actually Break Down
摘要
HTTP is the foundational protocol of the World Wide Web, designed with a strict set of specifications that developers are expected to follow. However, real-world implementations often deviate from these standards. In this study, we not only confirm these inconsistencies but build on previous work [45] to reveal a deeper issue: the impact of network middleboxes. Using a novel framework, we demonstrate that HTTP server conformance cannot be accurately assessed in isolation, as middleboxes can alter requests and responses in transit. We conducted 47 conformance tests on 12 popular proxy implementations. Our results show that none of them are fully compliant with the relevant RFCs, and there is significant variation in their behaviors. This inconsistency stems from ambiguities in the RFCs, which fail to provide clear guidelines for these middleboxes. In some cases, the implementation choices made can lead to vulnerabilities.