romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 07:23:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

http09: disable HTTP/0.9 by default in both tool and library

Browse source 
As the plan has been laid out in DEPRECATED. Update docs accordingly and
verify in test 1174. Now requires the option to be set to allow HTTP/0.9
responses.

Closes #4191
This commit is contained in:
Daniel Stenberg 2019-08-05 09:45:23 +02:00
parent 4173868f66
commit a42b0957ab
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
12 changed files with 59 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/DEPRECATE.md
View file

@ -5,21 +5,6 @@ email the curl-library mailing list as soon as possible and explain to us why
this is a problem for you and how your use case can't be satisfied properly
using a work around.
## HTTP/0.9
Supporting this is non-obvious and might even come as a surprise to some
users. Potentially even being a security risk in some cases.
### State
curl 7.64.0 introduces options to disable/enable support for this protocol
version. The default remains supported for now.
### Removal
The support for HTTP/0.9 will be switched to disabled by default in 6 months,
in the September 2019 release (possibly called curl 7.68.0).
## PolarSSL
The polarssl TLS library has not had an update in over three years. The last

3
docs/cmdline-opts/http0.9.d
View file

@ -10,5 +10,4 @@ HTTP/0.9 is a completely headerless response and therefore you can also
connect with this to non-HTTP servers and still get a response since curl will
simply transparently downgrade - if allowed.
A future curl version will deny continuing if the response isn't at least
HTTP/1.0 unless this option is used.
Since curl 7.66.0, HTTP/0.9 is disabled by default.

10
docs/libcurl/opts/CURLOPT_HTTP09_ALLOWED.3
View file

@ -5,7 +5,7 @@
.\" * | (__| |_| | _ <| |___
.\" * \___|\___/|_| \_\_____|
.\" *
.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
.\" * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
.\" *
.\" * This software is licensed as described in the file COPYING, which
.\" * you should have received as part of this distribution. The terms
@ -31,12 +31,12 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTP09_ALLOWED, long allowed);
Pass the long argument \fIallowed\fP set to 1L to allow HTTP/0.9 responses.
A HTTP/0.9 response is a server response entirely without headers and only a
body, while you can connect to lots of random TCP services and still get a
response that curl might consider to be HTTP/0.9.
body. You can connect to lots of random TCP services and still get a response
that curl might consider to be HTTP/0.9!
.SH DEFAULT
curl allows HTTP/0.9 responses by default.
curl allowed HTTP/0.9 responses by default before 7.66.0
A future curl version will require this option to be set to allow HTTP/0.9
Since 7.66.0, libcurl requires this option set to 1L to allow HTTP/0.9
responses.
.SH PROTOCOLS
HTTP