Search code examples
urihaproxy

HaProxy replace all white spaces with a + character in request


I'm receiving a URL with whitespace in a query string, but HaProxy is marking such requests as bad requests I' trying to use reqrep parameter but nothing.

Example

http://example.com?ip=10.10.10.10, 1.0.0.0&xyz=abc

space between 10, 1 is not getting resolved by HaProxy.


Solution

  • Spaces in the URI are forbidden by RFC-3986, so you are essentially asking for HAProxy to accept a blatantly invalid request. It won't. Space characters are not valid and 400 Bad Request is the correct response. If you are receiving this from a client, then the client is broken.

    HAProxy has a proxy directive option accept-invalid-http-request that relaxes the parser a little bit to allow certain broken client behavior to work, but the documentation points out that ASCII 0x20 (decimal 32) is never allowed even with this option enabled.

    By default, HAProxy complies with RFC7230 in terms of message parsing. This means that invalid characters in header names are not permitted and cause an error to be returned to the client. This is the desired behavior as such forbidden characters are essentially used to build attacks exploiting server weaknesses, and bypass security filtering. Sometimes, a buggy browser or server will emit invalid header names for whatever reason (configuration, implementation) and the issue will not be immediately fixed. In such a case, it is possible to relax HAProxy's header name parser to accept any character even if that does not make sense, by specifying this option. Similarly, the list of characters allowed to appear in a URI is well defined by RFC3986, and chars 0-31, 32 (space), 34 ('"'), 60 ('<'), 62 ('>'), 92 ('\'), 94 ('^'), 96 ('`'), 123 ('{'), 124 ('|'), 125 ('}'), 127 (delete) and anything above are not allowed at all. HAProxy always blocks a number of them (0..32, 127). The remaining ones are blocked by default unless this option is enabled. (emphasis added)

    You can't use reqrep to modify a message that is already invalid.