Closes #110578. Restore previously disabled tests that depend on http://corefx-net-http11.azurewebsites.net.

Only outerloop tests are affected Build Information Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=891122 Build error leg or test failing: Pull request: Error Message Fill...

Peter Lenahan, linked with Tim Berners-Lee in early World Wide Web discussions, suggested the HTTP/1.1 Content-Name header in 1998. Learn about Peter Lenahan Wikipedia, net worth, downloading claims, ...

In this video, John Hammond interviews James Kettle, Research Director at Portswiger, to discuss his recent findings on security vulnerabilities related to the HTTP/1.1 protocol. James Kettle presented his research at the Black Hat and Defcon conferences, where he demonstrated the significant impact of "request smuggling" attacks on systems using HTTP/1.1. Kettle explains that the widely used HTTP/1.1 protocol has critical flaws that allow attackers to manipulate requests between front-end and back-end servers. This manipulation, known as "request smuggling," can lead to catastrophic consequences, such as user session hijacking, injection of malicious JavaScript, and compromise of sensitive web pages. Kettle illustrates these vulnerabilities with concrete examples, such as the attack he conducted on PayPal, where he was able to inject malicious JavaScript into the login page, stealing users' passwords. "Request smuggling" exploits the poor handling of request isolation in HTTP/1.1. By sending specially crafted requests, an attacker can create confusion between front-end and back-end servers, leading to unpredictable and dangerous behaviors. Kettle demonstrates how these attacks can be used to poison caches, redirect users to malicious sites, or even steal sensitive information. To illustrate these concepts, Kettle uses a tool he developed called HTTP Request Smuggler, which is available as open-source. This tool scans websites to detect "request smuggling" vulnerabilities. Kettle shows how the tool can identify discrepancies in request handling between front-end and back-end servers and how these discrepancies can be exploited to cause desynchronizations (desync attacks). Kettle also explains that current defenses against "request smuggling" are often ineffective and can be bypassed with subtle techniques, such as adding spaces or using specific headers. He demonstrates how these techniques can be used to cause desynchronizations and manipulate server responses. The practical implications of these findings are vast. Kettle reveals that his techniques have compromised major content delivery networks (CDNs) like Akamai, Cloudflare, and Fastly, meaning millions of websites are potentially vulnerable. He emphasizes that the only durable solution is to migrate to HTTP/2 or HTTP/3 for connections between front-end and back-end servers, as these protocols offer better request isolation. In conclusion, Kettle calls for increased awareness of these vulnerabilities and concrete actions to address them. He encourages security researchers to use his tools and labs to explore these flaws and contribute to improving web system security. To learn more, watch the full video at the following address: https://www.youtube.com/watch?v=n3Bw8CASnHE

A critical vulnerability has been identified in HTTP/1.1, enabling attackers to hijack websites. This flaw poses a significant risk to millions of sites that still rely on this widely-used protocol. The primary mitigation strategy suggested is upgrading to HTTP/2, which offers enhanced security features and performance improvements. The vulnerability could potentially lead to unauthorized access, data breaches, or website defacement, making it a pressing concern for web administrators. The impact on the cybersecurity landscape is substantial, given the widespread use of HTTP/1.1. Organizations are advised to prioritize upgrading to HTTP/2 to mitigate the risk of exploitation. Additionally, monitoring and detection tools should be implemented to identify any suspicious activity that might indicate an exploit attempt. This vulnerability underscores the importance of keeping web protocols up to date and highlights the potential risks associated with outdated technologies. For organizations that cannot immediately upgrade, applying available patches for HTTP/1.1 is crucial. The cybersecurity community must remain vigilant and proactive in addressing such vulnerabilities to ensure the integrity and security of web applications.

The whitepaper titled "HTTP/1.1 must die: the desync endgame" highlights significant vulnerabilities in the HTTP/1.1 protocol, particularly focusing on desynchronization (desync) attacks. HTTP/1.1, a cornerstone of web communication, has long been known for its susceptibility to various security issues. Desync vulnerabilities, which involve discrepancies in how servers and clients interpret request and response boundaries, can lead to severe security breaches such as request smuggling and response splitting. These vulnerabilities can be exploited to bypass security controls, manipulate web traffic, and gain unauthorized access to sensitive data. The technical implications of desync vulnerabilities are profound. They can disrupt the integrity and confidentiality of web communications, leading to potential data breaches and service disruptions. Given the widespread use of HTTP/1.1, the impact of such vulnerabilities on the cybersecurity landscape is substantial. Exploiting these vulnerabilities can compromise not only individual websites but also the broader web infrastructure, affecting numerous interconnected systems. From an expert perspective, addressing these vulnerabilities requires a multi-faceted approach. One immediate step is to implement stricter parsing and validation of HTTP requests and responses to prevent desynchronization. However, a more long-term and robust solution would be to transition to newer protocols like HTTP/2 or HTTP/3. These protocols have been designed with improved security features and better handling of request/response cycles, thereby mitigating many of the issues inherent in HTTP/1.1. For cybersecurity professionals, the actionable intelligence derived from this analysis includes conducting thorough audits of current web infrastructures to identify and patch desync vulnerabilities. Additionally, organizations should consider upgrading their protocols to HTTP/2 or HTTP/3 to leverage their enhanced security features. Regular monitoring and updating of security policies to adapt to emerging threats are also crucial. In conclusion, while HTTP/1.1 has been a fundamental protocol for web communication, its vulnerabilities, particularly desync issues, pose significant risks. The cybersecurity community must take proactive steps to mitigate these risks and consider transitioning to more secure protocols to ensure the integrity and security of web communications.

You've built APIs. You've debugged mysterious 400s at 2am. You know HTTP "well enough" — until you don't. This article is the reference I wish existed when I was stepping up from "it works" to "I...