Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-51557

QHttpNetworkConnection: Move http header field "host" to the top

    XMLWordPrintable

Details

    • Suggestion
    • Resolution: Done
    • P4: Low
    • 5.10.1
    • 5.5.1
    • Network, Network: HTTP
    • None

    Description

      ref https://bugreports.qt.io/browse/QTBUG-49659

      PhantomJS, a headless browser, (http://phantomjs.org/) uses QT for networking. It is meant for automating web tasks, but unfortunatley this client has been used as a bot in DDoS-attacks too. And because QT uses an arbitrarty ordering of http header fields (for example, "host" is the last field, most browsers send this first), it's possible to identify the library/client, thus all applications that uses QT for networking that does requests against bot-protected sites (Incapsula, Cloudflare, etc) will deem http-requests as suspecious and may even be blocked.

      RFC 7230 - Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing:
      The order in which header fields with differing field names are received is not significant. However, it is good practice to send header fields that contain control data first, such as Host on requests and Date on responses, so that implementations can decide when not to handle a message as early as possible.

      First order of business would be to bump the field "Host" to the top, but I would also suggest looking at the way modern browser sends (FireFox, Chrome) their headers and try to make QT send the headers in roughly the same order in order to make it harder for Incapsula to discriminate requests from QT.

      File in question: qhttpnetworkconnection.cpp
      void QHttpNetworkConnectionPrivate::prepareRequest(HttpMessagePair &messagePair)

      Attachments

        Issue Links

          For Gerrit Dashboard: QTBUG-51557
          # Subject Branch Project Status CR V

          Activity

            People

              annulen Konstantin Tokarev
              Spartakus Vidar F
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes