Opened 8 months ago

Closed 5 weeks ago

#1882 closed defect (wontfix)

Nginx does not handle asterisk in OPTIONS request

Reported by: wes.wesk.tech@… Owned by:
Priority: minor Milestone:
Component: nginx-core Version: 1.17.x
Keywords: options Cc:
uname -a:
nginx -V: 1.17.3

Description

According to RFC 2616, this should be a valid request

OPTIONS * HTTP/1.1\r\n
Host: blah\r\n

Yet, if you try this, Nginx returns 400 Bad Request.

E.g. curl -X OPTIONS --request-target "*" https://nginx.org

Nginx should support the RFC and allow this type of request (even if it does absolutely nothing and returns an empty response).

See https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

Change History (1)

comment:1 by Maxim Dounin, 5 weeks ago

Resolution: wontfix
Status: newclosed

From RFC point of view, 400 Bad Request is a valid response. Since nginx does not expect any "OPTIONS *" requests, it returns 400 (which happens automatically due to request line parsing restrictions).

While there might be practical reasons to return something different, we aren't aware of any. As such, for now it looks like nginx behaviour is valid per RFC, and there are no practical reasons to change it.

Note: See TracTickets for help on using tickets.