rfc7230_SUITE.erl 51 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401
  1. %% Copyright (c) 2015-2017, Loïc Hoguin <essen@ninenines.eu>
  2. %%
  3. %% Permission to use, copy, modify, and/or distribute this software for any
  4. %% purpose with or without fee is hereby granted, provided that the above
  5. %% copyright notice and this permission notice appear in all copies.
  6. %%
  7. %% THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  8. %% WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  9. %% MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  10. %% ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  11. %% WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  12. %% ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  13. %% OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  14. -module(rfc7230_SUITE).
  15. -compile(export_all).
  16. -import(ct_helper, [doc/1]).
  17. -import(cowboy_test, [raw_open/1]).
  18. -import(cowboy_test, [raw_send/2]).
  19. -import(cowboy_test, [raw_recv_head/1]).
  20. -import(cowboy_test, [raw_recv/3]).
  21. all() -> [{group, http}].
  22. groups() -> [{http, [parallel], ct_helper:all(?MODULE)}]. %% @todo parallel
  23. init_per_group(Name = http, Config) ->
  24. cowboy_test:init_http(Name = http, #{
  25. env => #{dispatch => cowboy_router:compile(init_routes(Config))}
  26. }, Config).
  27. end_per_group(Name, _) ->
  28. ok = cowboy:stop_listener(Name).
  29. init_routes(_) -> [
  30. {"localhost", [
  31. {"/", hello_h, []},
  32. {"/echo/:key", echo_h, []}
  33. %% @todo Something is clearly wrong about routing * right now.
  34. %% {"*", asterisk_h, []}
  35. ]},
  36. {"127.0.0.1", [{"/echo/:key", echo_h, []}]},
  37. {"example.org", [{"/echo/:key", echo_h, []}]}
  38. %% @todo Add IPv6 addresses support to the router. This fails:
  39. %% {"[2001:db8:85a3::8a2e:370:7334]", [{"/echo/:key", echo_h, []}]}
  40. ].
  41. do_raw(Config, Data) ->
  42. Client = raw_open(Config),
  43. ok = raw_send(Client, Data),
  44. {Version, Code, Reason, Rest} = cow_http:parse_status_line(raw_recv_head(Client)),
  45. {Headers, Rest2} = cow_http:parse_headers(Rest),
  46. case lists:keyfind(<<"content-length">>, 1, Headers) of
  47. {_, LengthBin} when LengthBin =/= <<"0">> ->
  48. Length = binary_to_integer(LengthBin),
  49. Body = if
  50. byte_size(Rest2) =:= Length -> Rest2;
  51. true ->
  52. {ok, Body0} = raw_recv(Client, binary_to_integer(LengthBin) - byte_size(Rest2), 5000),
  53. << Rest2/bits, Body0/bits >>
  54. end,
  55. #{client => Client, version => Version, code => Code, reason => Reason, headers => Headers, body => Body};
  56. _ ->
  57. #{client => Client, version => Version, code => Code, reason => Reason, headers => Headers, body => <<>>}
  58. end.
  59. %% Listener.
  60. %% @todo Add to documentation.
  61. %The default port for "http" connections is 80. The connection
  62. %uses plain TCP. (RFC7230 2.7.1)
  63. %
  64. %The default port for "https" connections is 443. The connection
  65. %uses TLS. (RFC7230 2.7.2)
  66. %
  67. %Any other port may be used for either of them.
  68. %% Before the request.
  69. accept_at_least_1_empty_line(Config) ->
  70. doc("A configurable number of empty lines (CRLF) preceding the request "
  71. "must be ignored. At least 1 empty line must be ignored. (RFC7230 3.5)"),
  72. #{code := 200} = do_raw(Config,
  73. "\r\n"
  74. "GET / HTTP/1.1\r\n"
  75. "Host: localhost\r\n"
  76. "\r\n").
  77. reject_response(Config) ->
  78. doc("When receiving a response instead of a request, identified by the "
  79. "status-line which starts with the HTTP version, the server must "
  80. "reject the message with a 400 status code and close the connection. (RFC7230 3.1)"),
  81. #{code := 400, client := Client} = do_raw(Config,
  82. "HTTP/1.1 200 OK\r\n"
  83. "\r\n"),
  84. {error, closed} = raw_recv(Client, 0, 1000).
  85. %% Request.
  86. only_parse_necessary_elements(Config) ->
  87. doc("It is only necessary to parse elements required to process the request. (RFC7230 2.5)"),
  88. #{code := 200} = do_raw(Config,
  89. "GET / HTTP/1.1\r\n"
  90. "Host: localhost\r\n"
  91. "Content-type: purposefully bad header value\r\n"
  92. "\r\n").
  93. %% @todo Add to documentation.
  94. %Parsed elements are subject to configurable limits. A server must
  95. %be able to parse elements at least as long as it generates. (RFC7230 2.5)
  96. no_empty_line_after_request_line(Config) ->
  97. doc("The general format of HTTP requests is strict. No empty line is "
  98. "allowed in-between components except for the empty line "
  99. "indicating the end of the list of headers."),
  100. #{code := 400} = do_raw(Config,
  101. "GET / HTTP/1.1\r\n"
  102. "\r\n"
  103. "Host: localhost\r\n"
  104. "\r\n").
  105. no_empty_line_in_headers(Config) ->
  106. doc("The general format of HTTP requests is strict. No empty line is "
  107. "allowed in-between components except for the empty line "
  108. "indicating the end of the list of headers."),
  109. #{code := 400} = do_raw(Config,
  110. "GET / HTTP/1.1\r\n"
  111. "User-Agent: RFC7230\r\n"
  112. "\r\n"
  113. "Host: localhost\r\n"
  114. "\r\n").
  115. timeout_before_request_line(Config) ->
  116. doc("The time the request (request line and headers) takes to be "
  117. "received by the server must be limited and subject to configuration. "
  118. "No response must be sent before closing if no request was initiated "
  119. "by the reception of a complete request-line."),
  120. Client = raw_open(Config),
  121. ok = raw_send(Client, "GET / HTTP/1.1\r"),
  122. {error, closed} = raw_recv(Client, 0, 6000).
  123. timeout_after_request_line(Config) ->
  124. doc("The time the request (request line and headers) takes to be "
  125. "received by the server must be limited and subject to configuration. "
  126. "A 408 status code must be sent if the request line was received."),
  127. #{code := 408, client := Client} = do_raw(Config, "GET / HTTP/1.1\r\n"),
  128. {error, closed} = raw_recv(Client, 0, 6000).
  129. %% @todo Add an HTTP/1.0 test suite.
  130. %An HTTP/1.1 server must understand any valid HTTP/1.0 request,
  131. %and respond to those with an HTTP/1.1 message that only use
  132. %features understood or safely ignored by HTTP/1.0 clients. (RFC7230 A)
  133. %% Request line.
  134. limit_request_line_8000(Config) ->
  135. doc("It is recommended to limit the request-line length to a configurable "
  136. "limit of at least 8000 octets."),
  137. LongPath = ["/long-path" || _ <- lists:seq(1, 799)],
  138. #{code := 200} = do_raw(Config, [
  139. "GET /?qs=", LongPath, " HTTP/1.1\r\n"
  140. "Host: localhost\r\n"
  141. "\r\n"]).
  142. limit_request_line_9000(Config) ->
  143. doc("It is recommended to limit the request-line length to a configurable "
  144. "limit of at least 8000 octets. A request line too long must be rejected "
  145. "with a 414 status code and the closing of the connection. (RFC7230 3.1.1)"),
  146. LongPath = ["/long-path" || _ <- lists:seq(1, 899)],
  147. #{code := 414, client := Client} = do_raw(Config, [
  148. "GET /very", LongPath, " HTTP/1.1\r\n"
  149. "Host: localhost\r\n"
  150. "\r\n"]),
  151. {error, closed} = raw_recv(Client, 0, 1000).
  152. %% Method.
  153. reject_invalid_method(Config) ->
  154. doc("The request method is defined as 1+ token characters. An invalid "
  155. "method must be rejected with a 400 status code and the "
  156. "closing of the connection. (RFC7230 3.1.1, RFC7230 3.2.6)"),
  157. #{code := 400, client := Client} = do_raw(Config,
  158. "GET\0 / HTTP/1.1\r\n"
  159. "Host: localhost\r\n"
  160. "\r\n"),
  161. {error, closed} = raw_recv(Client, 0, 1000).
  162. reject_empty_method(Config) ->
  163. doc("The request method is defined as 1+ token characters. An empty "
  164. "method must be rejected with a 400 status code and the "
  165. "closing of the connection. (RFC7230 3.1.1, RFC7230 3.2.6)"),
  166. #{code := 400, client := Client} = do_raw(Config,
  167. " / HTTP/1.1\r\n"
  168. "Host: localhost\r\n"
  169. "\r\n"),
  170. {error, closed} = raw_recv(Client, 0, 1000).
  171. %% @todo We probably want to directly match commonly used methods.
  172. %In practice the only characters in use by registered methods are
  173. %uppercase letters [A-Z] and the dash "-". (IANA HTTP Method Registry)
  174. limit_method_name(Config) ->
  175. doc("The length of the method must be subject to a configurable limit. "
  176. "A method too long must be rejected with a 501 status code and the "
  177. "closing of the connection. A good default for the method length limit "
  178. "is the longest method length the server implements. (RFC7230 3.1.1)"),
  179. LongMethod = [$G || _ <- lists:seq(1, 1000)],
  180. #{code := 501, client := Client} = do_raw(Config, [
  181. LongMethod, " / HTTP/1.1\r\n"
  182. "Host: localhost\r\n"
  183. "\r\n"]),
  184. {error, closed} = raw_recv(Client, 0, 1000).
  185. %% Between method and request-target.
  186. reject_tab_between_method_and_request_target(Config) ->
  187. doc("A request that uses anything other than SP as separator between "
  188. "the method and the request-target must be rejected with a 400 "
  189. "status code and the closing of the connection. (RFC7230 3.1.1, RFC7230 3.5)"),
  190. #{code := 400, client := Client} = do_raw(Config,
  191. "GET\t/ HTTP/1.1\r\n"
  192. "Host: localhost\r\n"
  193. "\r\n"),
  194. {error, closed} = raw_recv(Client, 0, 1000).
  195. reject_two_sp_between_method_and_request_target(Config) ->
  196. doc("A request that uses anything other than SP as separator between "
  197. "the method and the request-target must be rejected with a 400 "
  198. "status code and the closing of the connection. (RFC7230 3.1.1, RFC7230 3.5)"),
  199. #{code := 400, client := Client} = do_raw(Config,
  200. "GET / HTTP/1.1\r\n"
  201. "Host: localhost\r\n"
  202. "\r\n"),
  203. {error, closed} = raw_recv(Client, 0, 1000).
  204. %% Request target.
  205. ignore_uri_fragment_after_path(Config) ->
  206. doc("The fragment part of the target URI is not sent. It must be "
  207. "ignored by a server receiving it. (RFC7230 5.1)"),
  208. Echo = <<"http://localhost/echo/url">>,
  209. #{code := 200, body := Echo} = do_raw(Config,
  210. "GET /echo/url#fragment HTTP/1.1\r\n"
  211. "Host: localhost\r\n"
  212. "\r\n").
  213. ignore_uri_fragment_after_query(Config) ->
  214. doc("The fragment part of the target URI is not sent. It must be "
  215. "ignored by a server receiving it. (RFC7230 5.1)"),
  216. Echo = <<"http://localhost/echo/url?key=value">>,
  217. #{code := 200, body := Echo} = do_raw(Config,
  218. "GET /echo/url?key=value#fragment HTTP/1.1\r\n"
  219. "Host: localhost\r\n"
  220. "\r\n").
  221. %% Request target: origin-form.
  222. must_understand_origin_form(Config) ->
  223. doc("A server must be able to handle at least origin-form and absolute-form. (RFC7230 5.3.2)"),
  224. #{code := 200} = do_raw(Config,
  225. "GET / HTTP/1.1\r\n"
  226. "Host: localhost\r\n"
  227. "\r\n").
  228. origin_form_reject_if_connect(Config) ->
  229. doc("origin-form is used when the client does not connect to a proxy, "
  230. "does not use the CONNECT method and does not issue a site-wide "
  231. "OPTIONS request. (RFC7230 5.3.1)"),
  232. #{code := 400, client := Client} = do_raw(Config,
  233. "CONNECT / HTTP/1.1\r\n"
  234. "Host: localhost\r\n"
  235. "\r\n"),
  236. {error, closed} = raw_recv(Client, 0, 1000).
  237. %% @todo Equivalent test for https.
  238. origin_form_tcp_scheme(Config) ->
  239. doc("The scheme is either resolved from configuration or is \"https\" "
  240. "when on a TLS connection and \"http\" otherwise. (RFC7230 5.5)"),
  241. Echo = <<"http://localhost/echo/url">>,
  242. #{code := 200, body := Echo} = do_raw(Config,
  243. "GET /echo/url HTTP/1.1\r\n"
  244. "Host: localhost\r\n"
  245. "\r\n").
  246. origin_form_path(Config) ->
  247. doc("The absolute-path always starts with \"/\" and ends with either \"?\", \"#\" "
  248. "or the end of the URI. (RFC3986 3.3)"),
  249. Echo = <<"/echo/path">>,
  250. #{code := 200, body := Echo} = do_raw(Config,
  251. "GET /echo/path HTTP/1.1\r\n"
  252. "Host: localhost\r\n"
  253. "\r\n").
  254. origin_form_path_query(Config) ->
  255. doc("The absolute-path always starts with \"/\" and ends with either \"?\", \"#\" "
  256. "or the end of the URI. (RFC3986 3.3)"),
  257. Echo = <<"/echo/path">>,
  258. #{code := 200, body := Echo} = do_raw(Config,
  259. "GET /echo/path?key=value HTTP/1.1\r\n"
  260. "Host: localhost\r\n"
  261. "\r\n").
  262. origin_form_path_fragment(Config) ->
  263. doc("The absolute-path always starts with \"/\" and ends with either \"?\", \"#\" "
  264. "or the end of the URI. (RFC3986 3.3)"),
  265. Echo = <<"/echo/path">>,
  266. #{code := 200, body := Echo} = do_raw(Config,
  267. "GET /echo/path#fragment HTTP/1.1\r\n"
  268. "Host: localhost\r\n"
  269. "\r\n").
  270. origin_form_query(Config) ->
  271. doc("The query starts with \"?\" and ends with \"#\" or the end of the URI. (RFC3986 3.4)"),
  272. Echo = <<"key=value">>,
  273. #{code := 200, body := Echo} = do_raw(Config,
  274. "GET /echo/qs?key=value HTTP/1.1\r\n"
  275. "Host: localhost\r\n"
  276. "\r\n").
  277. origin_form_query_fragment(Config) ->
  278. doc("The query starts with \"?\" and ends with \"#\" or the end of the URI. (RFC3986 3.4)"),
  279. Echo = <<"key=value">>,
  280. #{code := 200, body := Echo} = do_raw(Config,
  281. "GET /echo/qs?key=value#fragment HTTP/1.1\r\n"
  282. "Host: localhost\r\n"
  283. "\r\n").
  284. %% @todo origin_form: reject paths with too large depth or query strings with too many keys
  285. %% Request target: absolute-form.
  286. must_understand_absolute_form(Config) ->
  287. doc("A server must be able to handle at least origin-form and absolute-form. (RFC7230 5.3.2)"),
  288. #{code := 200} = do_raw(Config,
  289. "GET http://localhost HTTP/1.1\r\n"
  290. "Host: localhost\r\n"
  291. "\r\n").
  292. absolute_form_case_insensitive_scheme(Config) ->
  293. doc("The scheme is case insensitive and normally provided in lowercase. (RFC7230 2.7.3)"),
  294. Echo = <<"http://localhost/echo/url">>,
  295. #{code := 200, body := Echo} = do_raw(Config,
  296. "GET HttP://localhost/echo/url HTTP/1.1\r\n"
  297. "Host: localhost\r\n"
  298. "\r\n").
  299. absolute_form_case_insensitive_host(Config) ->
  300. doc("The host is case insensitive and normally provided in lowercase. (RFC7230 2.7.3)"),
  301. Echo = <<"http://localhost/echo/url">>,
  302. #{code := 200, body := Echo} = do_raw(Config,
  303. "GET http://LoCaLHOsT/echo/url HTTP/1.1\r\n"
  304. "Host: localhost\r\n"
  305. "\r\n").
  306. absolute_form_reject_unknown_schemes(Config) ->
  307. doc("Unknown schemes must be rejected with a 400 status code and the closing of the connection."),
  308. #{code := 400, client := Client} = do_raw(Config,
  309. "GET bad://localhost/ HTTP/1.1\r\n"
  310. "Host: localhost\r\n"
  311. "\r\n"),
  312. {error, closed} = raw_recv(Client, 0, 1000).
  313. %% @todo Equivalent test for https.
  314. absolute_form_drop_scheme_tcp(Config) ->
  315. doc("The scheme provided with the request must be dropped. The effective "
  316. "scheme is either resolved from configuration or is \"https\" when on "
  317. "a TLS connection and \"http\" otherwise. (RFC7230 5.5)"),
  318. Echo = <<"http://localhost/echo/url">>,
  319. #{code := 200, body := Echo} = do_raw(Config,
  320. "GET https://localhost/echo/url HTTP/1.1\r\n"
  321. "Host: localhost\r\n"
  322. "\r\n").
  323. absolute_form_reject_userinfo(Config) ->
  324. doc("An authority component with a userinfo component (and its "
  325. "\"@\" delimiter) is invalid. The request must be rejected with "
  326. "a 400 status code and the closing of the connection. (RFC7230 2.7.1)"),
  327. #{code := 400, client := Client} = do_raw(Config,
  328. "GET http://username:password@localhost HTTP/1.1\r\n"
  329. "Host: localhost\r\n"
  330. "\r\n"),
  331. {error, closed} = raw_recv(Client, 0, 1000).
  332. absolute_form_reject_missing_host_without_path(Config) ->
  333. doc("A URI with a missing host identifier is invalid. The request must "
  334. "be rejected with a 400 status code and the closing of the connection. (RFC7230 2.7.1)"),
  335. #{code := 400, client := Client} = do_raw(Config,
  336. "GET http:// HTTP/1.1\r\n"
  337. "Host: localhost\r\n"
  338. "\r\n"),
  339. {error, closed} = raw_recv(Client, 0, 1000).
  340. absolute_form_reject_missing_host_with_path(Config) ->
  341. doc("A URI with a missing host identifier is invalid. The request must "
  342. "be rejected with a 400 status code and the closing of the connection. (RFC7230 2.7.1)"),
  343. #{code := 400, client := Client} = do_raw(Config,
  344. "GET http:/// HTTP/1.1\r\n"
  345. "Host: localhost\r\n"
  346. "\r\n"),
  347. {error, closed} = raw_recv(Client, 0, 1000).
  348. absolute_form_ipv4(Config) ->
  349. doc("Absolute form with an IPv4 address for the host. (RFC3986 3.2.2)"),
  350. Echo = <<"127.0.0.1">>,
  351. #{code := 200, body := Echo} = do_raw(Config,
  352. "GET http://127.0.0.1/echo/host HTTP/1.1\r\n"
  353. "Host: 127.0.0.1\r\n"
  354. "\r\n").
  355. absolute_form_ipv4_port(Config) ->
  356. doc("Absolute form with an IPv4 address for the host and a port number. (RFC3986 3.2.2)"),
  357. Host = <<"127.0.0.1">>,
  358. #{code := 200, body := Host} = do_raw(Config,
  359. "GET http://127.0.0.1:8080/echo/host HTTP/1.1\r\n"
  360. "Host: 127.0.0.1:8080\r\n"
  361. "\r\n"),
  362. Port = <<"8080">>,
  363. #{code := 200, body := Port} = do_raw(Config,
  364. "GET http://127.0.0.1:8080/echo/port HTTP/1.1\r\n"
  365. "Host: 127.0.0.1:8080\r\n"
  366. "\r\n").
  367. %% @todo We need the router to support IPv6 addresses to write proper tests for these:
  368. %absolute_form_ipv6(Config) ->
  369. %absolute_form_ipv6_ipv4(Config) ->
  370. %absolute_form_ipv6_zoneid(Config) ->
  371. absolute_form_reg_name(Config) ->
  372. doc("Absolute form with a regular name for the host. (RFC3986 3.2.2)"),
  373. Echo = <<"example.org">>,
  374. #{code := 200, body := Echo} = do_raw(Config,
  375. "GET http://example.org/echo/host HTTP/1.1\r\n"
  376. "Host: example.org\r\n"
  377. "\r\n").
  378. absolute_form_reg_name_port(Config) ->
  379. doc("Absolute form with an IPv4 address for the host and a port number. (RFC3986 3.2.2)"),
  380. Host = <<"example.org">>,
  381. #{code := 200, body := Host} = do_raw(Config,
  382. "GET http://example.org:8080/echo/host HTTP/1.1\r\n"
  383. "Host: example.org:8080\r\n"
  384. "\r\n"),
  385. Port = <<"8080">>,
  386. #{code := 200, body := Port} = do_raw(Config,
  387. "GET http://example.org:8080/echo/port HTTP/1.1\r\n"
  388. "Host: example.org:8080\r\n"
  389. "\r\n").
  390. absolute_form_limit_host(Config) ->
  391. doc("The maximum length for the host component of the URI must be subject "
  392. "to a configurable limit. A good default is 255 characters. "
  393. "(RFC7230 3.1.1, RFC3986 3.2.2, RFC1034 3.1)"),
  394. LongHost = ["host." || _ <- lists:seq(1, 100)],
  395. #{code := 414, client := Client} = do_raw(Config, [
  396. "GET http://", LongHost, "/ HTTP/1.1\r\n"
  397. "Host: ", LongHost, "\r\n"
  398. "\r\n"]),
  399. {error, closed} = raw_recv(Client, 0, 1000).
  400. absolute_form_invalid_port_0(Config) ->
  401. doc("Port number 0 is reserved. The request must be rejected and the connection closed."),
  402. #{code := 400, client := Client} = do_raw(Config,
  403. "GET http://localhost:0/ HTTP/1.1\r\n"
  404. "Host: localhost:0\r\n"
  405. "\r\n"),
  406. {error, closed} = raw_recv(Client, 0, 1000).
  407. absolute_form_invalid_port_65536(Config) ->
  408. doc("Port numbers above 65535 are invalid. The request must be rejected and the connection closed."),
  409. #{code := 400, client := Client} = do_raw(Config,
  410. "GET http://localhost:65536/ HTTP/1.1\r\n"
  411. "Host: localhost:65536\r\n"
  412. "\r\n"),
  413. {error, closed} = raw_recv(Client, 0, 1000).
  414. %% @todo The RFC says to discard the Host header if we are a proxy,
  415. %% and replace it with the content of absolute-form. This means
  416. %% that we should probably keep the absolute-form value when
  417. %% operating in proxy mode. Otherwise the absolute-form value
  418. %% is simply dropped and the Host header is used.
  419. %% @todo The authority is sent both in the URI and in the host header.
  420. %% The authority from the URI must be dropped, and the host header
  421. %% must be used instead. (RFC7230 5.5)
  422. %%
  423. %% It is not possible to test that the absolute-form value is dropped
  424. %% because one of the Host header test ensures that the authority
  425. %% is the same in both, and errors out otherwise.
  426. absolute_form_path(Config) ->
  427. doc("The path always starts with \"/\" and ends with either \"?\", \"#\" "
  428. "or the end of the URI. (RFC3986 3.3)"),
  429. Echo = <<"/echo/path">>,
  430. #{code := 200, body := Echo} = do_raw(Config,
  431. "GET http://localhost/echo/path HTTP/1.1\r\n"
  432. "Host: localhost\r\n"
  433. "\r\n").
  434. absolute_form_path_query(Config) ->
  435. doc("The path always starts with \"/\" and ends with either \"?\", \"#\" "
  436. "or the end of the URI. (RFC3986 3.3)"),
  437. Echo = <<"/echo/path">>,
  438. #{code := 200, body := Echo} = do_raw(Config,
  439. "GET http://localhost/echo/path?key=value HTTP/1.1\r\n"
  440. "Host: localhost\r\n"
  441. "\r\n").
  442. absolute_form_path_fragment(Config) ->
  443. doc("The path always starts with \"/\" and ends with either \"?\", \"#\" "
  444. "or the end of the URI. (RFC3986 3.3)"),
  445. Echo = <<"/echo/path">>,
  446. #{code := 200, body := Echo} = do_raw(Config,
  447. "GET http://localhost/echo/path#fragment HTTP/1.1\r\n"
  448. "Host: localhost\r\n"
  449. "\r\n").
  450. absolute_form_no_path(Config) ->
  451. doc("An empty path component is equivalent to \"/\". (RFC7230 2.7.3)"),
  452. #{code := 200, body := <<"Hello world!">>} = do_raw(Config,
  453. "GET http://localhost HTTP/1.1\r\n"
  454. "Host: localhost\r\n"
  455. "\r\n").
  456. absolute_form_no_path_then_query(Config) ->
  457. doc("An empty path component is equivalent to \"/\". (RFC7230 2.7.3)"),
  458. #{code := 200, body := <<"Hello world!">>} = do_raw(Config,
  459. "GET http://localhost?key=value HTTP/1.1\r\n"
  460. "Host: localhost\r\n"
  461. "\r\n").
  462. absolute_form_no_path_then_fragment(Config) ->
  463. doc("An empty path component is equivalent to \"/\". (RFC7230 2.7.3)"),
  464. #{code := 200, body := <<"Hello world!">>} = do_raw(Config,
  465. "GET http://localhost#fragment HTTP/1.1\r\n"
  466. "Host: localhost\r\n"
  467. "\r\n").
  468. absolute_form_query(Config) ->
  469. doc("The query starts with \"?\" and ends with \"#\" or the end of the URI. (RFC3986 3.4)"),
  470. Echo = <<"key=value">>,
  471. #{code := 200, body := Echo} = do_raw(Config,
  472. "GET http://localhost/echo/qs?key=value HTTP/1.1\r\n"
  473. "Host: localhost\r\n"
  474. "\r\n").
  475. absolute_form_query_fragment(Config) ->
  476. doc("The query starts with \"?\" and ends with \"#\" or the end of the URI. (RFC3986 3.4)"),
  477. Echo = <<"key=value">>,
  478. #{code := 200, body := Echo} = do_raw(Config,
  479. "GET http://localhost/echo/qs?key=value#fragment HTTP/1.1\r\n"
  480. "Host: localhost\r\n"
  481. "\r\n").
  482. %% @todo absolute_form: reject paths with too large depth or query strings with too many keys
  483. %% Request-target: authority-form.
  484. authority_form_reject_if_not_connect(Config) ->
  485. doc("When the method is CONNECT, authority-form must be used. This "
  486. "form does not apply to any other methods which must reject the "
  487. "request with a 400 status code and the closing of the connection. (RFC7230 5.3.3)"),
  488. #{code := 400, client := Client} = do_raw(Config,
  489. "GET localhost:80 HTTP/1.1\r\n"
  490. "Host: localhost\r\n"
  491. "\r\n"),
  492. {error, closed} = raw_recv(Client, 0, 1000).
  493. %% @todo Implement CONNECT.
  494. %authority_form_reject_userinfo(Config) ->
  495. %An authority component with a userinfo component (and its
  496. %"@" delimiter) is invalid. The request must be rejected with
  497. %a 400 status code and the closing of the connection. (RFC7230 2.7.1)
  498. %
  499. %authority_form_limit_host(Config) ->
  500. %authority_form_limit_port0(Config) ->
  501. %authority_form_limit_port65536(Config) ->
  502. %
  503. %A request with a too long component of authority-form must be rejected with
  504. %a 414 status code and the closing of the connection. (RFC7230 3.1.1)
  505. %
  506. %The authority is either resolved from configuration or is taken
  507. %directly from authority-form. (RFC7230 5.5)
  508. %
  509. %authority_form_empty_path(Config) ->
  510. %authority_form_empty_query(Config) ->
  511. %The path and query are empty when using authority-form. (RFC7230 5.5)
  512. %% Request-target: asterisk-form.
  513. asterisk_form_reject_if_not_options(Config) ->
  514. doc("asterisk-form is used for server-wide OPTIONS requests. "
  515. "It is invalid with any other methods which must reject the "
  516. "request with a 400 status code and the closing of the connection. (RFC7230 5.3.4)"),
  517. #{code := 400, client := Client} = do_raw(Config,
  518. "GET * HTTP/1.1\r\n"
  519. "Host: localhost\r\n"
  520. "\r\n"),
  521. {error, closed} = raw_recv(Client, 0, 1000).
  522. asterisk_form_empty_path(Config) ->
  523. doc("The path is empty when using asterisk-form. (RFC7230 5.5)"),
  524. #{code := 200, body := <<>>} = do_raw(Config,
  525. "OPTIONS * HTTP/1.1\r\n"
  526. "Host: localhost\r\n"
  527. "X-Echo: path\r\n"
  528. "\r\n").
  529. asterisk_form_empty_query(Config) ->
  530. doc("The query is empty when using asterisk-form. (RFC7230 5.5)"),
  531. #{code := 200, body := <<>>} = do_raw(Config,
  532. "OPTIONS * HTTP/1.1\r\n"
  533. "Host: localhost\r\n"
  534. "X-Echo: query\r\n"
  535. "\r\n").
  536. %% Invalid request-target.
  537. invalid_request_target(Config) ->
  538. doc("Any other form is invalid and must be rejected with a 400 status code "
  539. "and the closing of the connection."),
  540. #{code := 400, client := Client} = do_raw(Config,
  541. "GET \0 HTTP/1.1\r\n"
  542. "Host: localhost\r\n"
  543. "\r\n"),
  544. {error, closed} = raw_recv(Client, 0, 1000).
  545. %% Between request-target and version.
  546. reject_tab_between_request_target_and_version(Config) ->
  547. doc("A request that uses anything other than SP as separator between "
  548. "the request-target and the version must be rejected with a 400 "
  549. "status code and the closing of the connection. (RFC7230 3.1.1, RFC7230 3.5)"),
  550. #{code := 400, client := Client} = do_raw(Config,
  551. "GET /\tHTTP/1.1\r\n"
  552. "Host: localhost\r\n"
  553. "\r\n"),
  554. {error, closed} = raw_recv(Client, 0, 1000).
  555. reject_two_sp_between_request_target_and_version(Config) ->
  556. doc("A request that uses anything other than SP as separator between "
  557. "the request-target and the version must be rejected with a 400 "
  558. "status code and the closing of the connection. (RFC7230 3.1.1, RFC7230 3.5)"),
  559. #{code := 400, client := Client} = do_raw(Config,
  560. "GET / HTTP/1.1\r\n"
  561. "Host: localhost\r\n"
  562. "\r\n"),
  563. {error, closed} = raw_recv(Client, 0, 1000).
  564. %% Request version.
  565. reject_invalid_version_http100(Config) ->
  566. doc("Any version number other than HTTP/1.0 or HTTP/1.1 must be "
  567. "rejected by a server or intermediary with a 505 status code. (RFC7230 2.6, RFC7230 A.2)"),
  568. #{code := 505} = do_raw(Config,
  569. "GET / HTTP/1.00\r\n"
  570. "Host: localhost\r\n"
  571. "\r\n").
  572. reject_invalid_version_http111(Config) ->
  573. doc("Any version number other than HTTP/1.0 or HTTP/1.1 must be "
  574. "rejected by a server or intermediary with a 505 status code. (RFC7230 2.6, RFC7230 A.2)"),
  575. #{code := 505} = do_raw(Config,
  576. "GET / HTTP/1.11\r\n"
  577. "Host: localhost\r\n"
  578. "\r\n").
  579. reject_invalid_version_http12(Config) ->
  580. doc("Any version number other than HTTP/1.0 or HTTP/1.1 must be "
  581. "rejected by a server or intermediary with a 505 status code. (RFC7230 2.6, RFC7230 A.2)"),
  582. #{code := 505} = do_raw(Config,
  583. "GET / HTTP/1.2\r\n"
  584. "Host: localhost\r\n"
  585. "\r\n").
  586. reject_invalid_version_http2(Config) ->
  587. doc("Any version number other than HTTP/1.0 or HTTP/1.1 must be "
  588. "rejected by a server or intermediary with a 505 status code. (RFC7230 2.6, RFC7230 A.2)"),
  589. #{code := 505} = do_raw(Config,
  590. "GET / HTTP/2\r\n"
  591. "Host: localhost\r\n"
  592. "\r\n").
  593. reject_empty_version(Config) ->
  594. doc("Any version number other than HTTP/1.0 or HTTP/1.1 must be "
  595. "rejected by a server or intermediary with a 505 status code. (RFC7230 2.6, RFC7230 A.2)"),
  596. #{code := 505} = do_raw(Config,
  597. "GET / \r\n"
  598. "Host: localhost\r\n"
  599. "\r\n").
  600. reject_invalid_whitespace_after_version(Config) ->
  601. doc("A request that has whitespace different than CRLF following the "
  602. "version must be rejected with a 400 status code and the closing "
  603. "of the connection. (RFC7230 3.1.1)"),
  604. #{code := 400, client := Client} = do_raw(Config,
  605. "GET / HTTP/1.1 \r\n"
  606. "Host: localhost\r\n"
  607. "\r\n"),
  608. {error, closed} = raw_recv(Client, 0, 1000).
  609. %% Request headers.
  610. %invalid_header(Config) ->
  611. %```
  612. %headers = *( header-field CRLF ) CRLF
  613. %header-field = field-name ":" OWS field-value OWS
  614. %
  615. %field-name = token
  616. %field-value = *( SP / HTAB / %21-7E / %80-FF )
  617. %
  618. %OWS = *( SP / HTAB )
  619. %```
  620. %
  621. %lower_case_header(Config) ->
  622. %upper_case_header(Config) ->
  623. %mixed_case_header(Config) ->
  624. %The header field name is case insensitive. (RFC7230 3.2)
  625. %
  626. %reject_whitespace_before_header_name(Config) ->
  627. %Messages that contain whitespace before the header name must
  628. %be rejected with a 400 status code and the closing of the
  629. %connection. (RFC7230 3.2.4)
  630. %
  631. %reject_whitespace_between_header_name_and_colon(Config) ->
  632. %Messages that contain whitespace between the header name and
  633. %colon must be rejected with a 400 status code and the closing
  634. %of the connection. (RFC7230 3.2.4)
  635. limit_header_name(Config) ->
  636. doc("The header name must be subject to a configurable limit. A "
  637. "good default is 50 characters, well above the longest registered "
  638. "header. Such a request must be rejected with a 431 status code "
  639. "and the closing of the connection. "
  640. "(RFC7230 3.2.5, RFC6585 5, IANA Message Headers registry)"),
  641. #{code := 431, client := Client} = do_raw(Config, [
  642. "GET / HTTP/1.1\r\n"
  643. "Host: localhost\r\n",
  644. binary:copy(<<$a>>, 32768), ": bad\r\n"
  645. "\r\n"]),
  646. {error, closed} = raw_recv(Client, 0, 1000).
  647. limit_header_value(Config) ->
  648. doc("The header value and the optional whitespace around it must be "
  649. "subject to a configurable limit. There is no recommendations "
  650. "for the default. 4096 characters is known to work well. Such "
  651. "a request must be rejected with a 431 status code and the closing "
  652. "of the connection. (RFC7230 3.2.5, RFC6585 5)"),
  653. #{code := 431, client := Client} = do_raw(Config, [
  654. "GET / HTTP/1.1\r\n"
  655. "Host: localhost\r\n"
  656. "bad: ", binary:copy(<<$a>>, 32768), "\r\n"
  657. "\r\n"]),
  658. {error, closed} = raw_recv(Client, 0, 1000).
  659. %drop_whitespace_before_header_value(Config) ->
  660. %drop_whitespace_after_header_value(Config) ->
  661. %Optional whitespace before and after the header value is not
  662. %part of the value and must be dropped.
  663. %
  664. %@todo
  665. %The order of header fields with differing names is not significant. (RFC7230 3.2.2)
  666. %
  667. %@todo
  668. %The normal procedure for parsing headers is to read each header
  669. %field into a hash table by field name until the empty line. (RFC7230 3)
  670. %
  671. %reject_duplicate_content_length_header(Config) ->
  672. %reject_duplicate_host_header(Config) ->
  673. %Requests with duplicate content-length or host headers must be rejected
  674. %with a 400 status code and the closing of the connection. (RFC7230 3.3.2)
  675. %
  676. %combine_duplicate_headers(Config) ->
  677. %Other duplicate header fields must be combined by inserting a comma
  678. %between the values in the order they were received. (RFC7230 3.2.2)
  679. %
  680. %Duplicate header field names are only allowed when their value is
  681. %a comma-separated list. In practice there is no need to perform
  682. %a check while reading the headers as the value will become invalid
  683. %and the error can be handled while parsing the header later on. (RFC7230 3.2.2)
  684. %
  685. %wait_for_eoh_before_processing_request(Config) ->
  686. %The request must not be processed until all headers have arrived. (RFC7230 3.2.2)
  687. %
  688. %limit_headers(Config) ->
  689. %The number of headers allowed in a request must be subject to
  690. %a configurable limit. There is no recommendations for the default.
  691. %100 headers is known to work well. Such a request must be rejected
  692. %with a 431 status code and the closing of the connection. (RFC7230 3.2.5, RFC6585 5)
  693. %
  694. %@todo
  695. %When parsing header field values, the server must ignore empty
  696. %list elements, and not count those as the count of elements present. (RFC7230 7)
  697. %
  698. %@todo
  699. %The information in the via header is largely unreliable. (RFC7230 5.7.1)
  700. %
  701. %%% Request body.
  702. %
  703. %@todo
  704. %The message body is the octets after decoding any transfer
  705. %codings. (RFC7230 3.3)
  706. %
  707. %no_request_body(Config) ->
  708. %no_request_body_content_length_zero(Config) ->
  709. %request_body_content_length(Config) ->
  710. %request_body_transfer_encoding(Config) ->
  711. %A request has a message body only if it includes a transfer-encoding
  712. %header or a non-zero content-length header. (RFC7230 3.3)
  713. %
  714. %```
  715. %Transfer-Encoding = 1#transfer-coding
  716. %
  717. %transfer-coding = "chunked" / "compress" / "deflate" / "gzip" / transfer-extension
  718. %transfer-extension = token *( OWS ";" OWS transfer-parameter )
  719. %transfer-parameter = token BWS "=" BWS ( token / quoted-string )
  720. %```
  721. %
  722. %case_insensitive_transfer_encoding(Config) ->
  723. %The transfer-coding is case insensitive. (RFC7230 4)
  724. %
  725. %@todo
  726. %There are no known other transfer-extension with the exception of
  727. %deprecated aliases "x-compress" and "x-gzip". (IANA HTTP Transfer Coding Registry,
  728. %RFC7230 4.2.1, RFC7230 4.2.3, RFC7230 8.4.2)
  729. %
  730. %must_understand_chunked(Config) ->
  731. %A server must be able to handle at least chunked transfer-encoding.
  732. %This is also the only coding that sees widespread use. (RFC7230 3.3.1, RFC7230 4.1)
  733. %
  734. %reject_double_chunked_encoding(Config) ->
  735. %Messages encoded more than once with chunked transfer-encoding
  736. %must be rejected with a 400 status code and the closing of the
  737. %connection. (RFC7230 3.3.1)
  738. %
  739. %reject_non_terminal_chunked(Config) ->
  740. %Messages where chunked, when present, is not the last
  741. %transfer-encoding must be rejected with a 400 status code
  742. %and the closing of the connection. (RFC7230 3.3.3)
  743. %
  744. %@todo
  745. %Some non-conformant implementations send the "deflate" compressed
  746. %data without the zlib wrapper. (RFC7230 4.2.2)
  747. %
  748. %reject_unknown_transfer_encoding(Config) ->
  749. %Messages encoded with a transfer-encoding the server does not
  750. %understand must be rejected with a 501 status code and the
  751. %closing of the connection. (RFC7230 3.3.1)
  752. %
  753. %@todo
  754. %A server can reject requests with a body and no content-length
  755. %header with a 411 status code. (RFC7230 3.3.3)
  756. %
  757. %```
  758. %Content-Length = 1*DIGIT
  759. %```
  760. %
  761. %reject_invalid_content_length(Config) ->
  762. %A request with an invalid content-length header must be rejected
  763. %with a 400 status code and the closing of the connection. (RFC7230 3.3.3)
  764. %
  765. %@todo
  766. %The content-length header ranges from 0 to infinity. Requests
  767. %with a message body too large must be rejected with a 413 status
  768. %code and the closing of the connection. (RFC7230 3.3.2)
  769. %
  770. %ignore_content_length_when_transfer_encoding(Config) ->
  771. %When a message includes both transfer-encoding and content-length
  772. %headers, the content-length header must be removed before processing
  773. %the request. (RFC7230 3.3.3)
  774. %
  775. %socket_error_while_reading_body(Config) ->
  776. %If a socket error occurs while reading the body the server
  777. %must send a 400 status code response and close the connection. (RFC7230 3.3.3, RFC7230 3.4)
  778. %
  779. %timeout_while_reading_body(Config) ->
  780. %If a timeout occurs while reading the body the server must
  781. %send a 408 status code response and close the connection. (RFC7230 3.3.3, RFC7230 3.4)
  782. %
  783. %%% Body length.
  784. %
  785. %body_length_chunked_before(Config) ->
  786. %The length of a message with a transfer-encoding header can
  787. %only be determined on decoding completion. (RFC7230 3.3.3)
  788. %
  789. %body_length_chunked_after(Config) ->
  790. %Upon completion of chunk decoding the server must add a content-length
  791. %header with the value set to the total length of data read. (RFC7230 4.1.3)
  792. %
  793. %body_length_content_length(Config) ->
  794. %The length of a message with a content-length header is
  795. %the numeric value in octets found in the header. (RFC7230 3.3.3)
  796. %
  797. %body_length_zero(Config) ->
  798. %A message with no transfer-encoding or content-length header
  799. %has a body length of 0. (RFC7230 3.3.3)
  800. %
  801. %%% Chunked transfer-encoding.
  802. %
  803. %reject_invalid_chunk_size(Config) ->
  804. %
  805. %```
  806. %chunked-body = *chunk last-chunk trailer-part CRLF
  807. %
  808. %chunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF
  809. %chunk-size = 1*HEXDIG
  810. %chunk-data = 1*OCTET ; a sequence of chunk-size octets
  811. %
  812. %last-chunk = 1*("0") [ chunk-ext ] CRLF
  813. %```
  814. %
  815. %The chunk-size field is a string of hex digits indicating the size of
  816. %the chunk-data in octets.
  817. %
  818. %```
  819. %chunk-ext = *( ";" chunk-ext-name [ "=" chunk-ext-val ] )
  820. %chunk-ext-name = token
  821. %chunk-ext-val = token / quoted-string
  822. %```
  823. %
  824. %ignore_unknown_chunk_extensions(Config) ->
  825. %Unknown chunk extensions must be ignored. (RFC7230 4.1.1)
  826. %
  827. %reject_invalid_chunk_extensions(Config) ->
  828. %
  829. %limit_chunk_size_line(Config) ->
  830. %The chunk-size line length must be subject to configuration.
  831. %There are no recommended defaults, although 100 octets should work.
  832. %Requests with a too long line must be rejected with a 400 status
  833. %code and the closing of the connection.
  834. %
  835. %reject_invalid_chunk_line_crlf(Config) ->
  836. %reject_invalid_chunk_data_crlf(Config) ->
  837. %
  838. %```
  839. %trailer-part = *( header-field CRLF )
  840. %```
  841. %
  842. %%% @todo see headers above and reject the same way, space etc.
  843. %reject_invalid_trailer_part(Config) ->
  844. %
  845. %ignore_trailer_transfer_encoding(Config) ->
  846. %ignore_trailer_content_length(Config) ->
  847. %ignore_trailer_host(Config) ->
  848. %ignore_trailer_cache_control(Config) ->
  849. %ignore_trailer_expect(Config) ->
  850. %ignore_trailer_max_forwards(Config) ->
  851. %ignore_trailer_pragma(Config) ->
  852. %ignore_trailer_range(Config) ->
  853. %ignore_trailer_te(Config) ->
  854. %ignore_trailer_if_match(Config) ->
  855. %ignore_trailer_if_none_match(Config) ->
  856. %ignore_trailer_if_modified_since(Config) ->
  857. %ignore_trailer_if_unmodified_since(Config) ->
  858. %ignore_trailer_if_range(Config) ->
  859. %ignore_trailer_www_authenticate(Config) ->
  860. %ignore_trailer_authorization(Config) ->
  861. %ignore_trailer_proxy_authenticate(Config) ->
  862. %ignore_trailer_proxy_authorization(Config) ->
  863. %ignore_trailer_content_encoding(Config) ->
  864. %ignore_trailer_content_type(Config) ->
  865. %ignore_trailer_content_range(Config) ->
  866. %ignore_trailer_trailer(Config) ->
  867. %
  868. %ignore_trailer_header(Config, Header) ->
  869. %Trailing headers must not include transfer-encoding, content-length,
  870. %host, cache-control, expect, max-forwards, pragma, range, te,
  871. %if-match, if-none-match, if-modified-since, if-unmodified-since,
  872. %if-range, www-authenticate, authorization, proxy-authenticate,
  873. %proxy-authorization, age, cache-control, expires, date, location,
  874. %retry-after, vary, warning, content-encoding, content-type,
  875. %content-range, or trailer. (RFC7230 4.1.2)
  876. %
  877. %Trailer headers can be ignored safely. (RFC7230 4.1.2)
  878. %
  879. %When trailer headers are processed, invalid headers must be ignored.
  880. %Valid headers must be added to the list of headers of the request. (RFC7230 4.1.2)
  881. %
  882. %limit_trailer_headers(Config) ->
  883. %The number of trailer headers must be subject to configuration.
  884. %There is no known recommendations for the default. A value of 10
  885. %should cover most cases. Requests with too many trailer headers
  886. %must be rejected with a 431 status code and the closing of the
  887. %connection. (RFC6585 5)
  888. %
  889. %remove_transfer_encoding_chunked_after_body_read(Config) ->
  890. %Upon completion of chunk decoding the server must remove "chunked"
  891. %from the transfer-encoding header. This header must be removed if
  892. %it becomes empty following this removal. (RFC7230 4.1.3)
  893. %
  894. %remove_trailer_after_body_read(Config) ->
  895. %Upon completion of chunk decoding the server must remove the trailer
  896. %header from the list of headers. (RFC7230 4.1.3)
  897. %
  898. %```
  899. %Trailer = 1#field-name
  900. %```
  901. %
  902. %ignore_chunked_headers_not_in_trailer(Config) ->
  903. %The trailer header can be used to list the headers found in the
  904. %trailer. A server must have the option of ignoring trailer headers
  905. %that were not listed in the trailer header. (RFC7230 4.4)
  906. %
  907. %ignore_chunked_headers_if_trailer_not_in_connection(Config) ->
  908. %The trailer header must be listed in the connection header field.
  909. %Trailers must be ignored otherwise.
  910. %
  911. %%% @todo Though we need a compatibility mode as some clients don't send it...
  912. %reject_chunked_missing_end_crlf(Config) ->
  913. %@todo ending CRLF
  914. %
  915. %%% Connection management.
  916. %
  917. %@todo can probably test using auth
  918. %Never assume any two requests on a single connection come
  919. %from the same user agent. (RFC7230 2.3)
  920. %
  921. %```
  922. %Connection = 1#token ; case-insensitive
  923. %```
  924. %
  925. %The connection token is either case insensitive "close", "keep-alive"
  926. %or a header field name.
  927. %
  928. %There are no corresponding "close" or "keep-alive" headers. (RFC7230 8.1, RFC7230 A.2)
  929. %
  930. %The connection header is valid only for the immediate connection,
  931. %alongside any header field it lists. (RFC7230 6.1)
  932. %
  933. %The server must determine if the connection is persistent for
  934. %every message received by looking at the connection header and
  935. %HTTP version. (RFC7230 6.3)
  936. %
  937. %no_connection_header_keepalive(Config) ->
  938. %%% @todo http/1.0 suite? connection_keepalive(Config) ->
  939. %HTTP/1.1 requests with no "close" option and HTTP/1.0 with the
  940. %"keep-alive" option indicate the connection will persist. (RFC7230 6.1, RFC7230 6.3)
  941. %
  942. %connection_close(Config) ->
  943. %%% @todo http/1.0 suite? no_connection_close(Config) ->
  944. %HTTP/1.1 requests with the "close" option and HTTP/1.0 with no
  945. %"keep-alive" option indicate the connection will be closed
  946. %upon reception of the response by the client. (RFC7230 6.1, RFC7230 6.3)
  947. %
  948. %limit_requests_keepalive(Config) ->
  949. %The maximum number of requests sent using a persistent connection
  950. %must be subject to configuration. The connection must be closed
  951. %when the limit is reached. (RFC7230 6.3)
  952. %
  953. %skip_request_body_by_closing_connection(Config) ->
  954. %%A server that doesn't want to read the entire body of a message
  955. %%must close the connection, if possible after sending the "close"
  956. %%connection option in the response. (RFC7230 6.3)
  957. %
  958. %pipeline(Config) ->
  959. %%% @todo pipeline_parallel (safe methods can, others can't)
  960. %A server can receive more than one request before any response
  961. %is sent. This is called pipelining. The requests can be processed
  962. %in parallel if they all have safe methods. Responses must be sent
  963. %in the same order as the requests. (RFC7230 6.3.2)
  964. %
  965. %@todo
  966. %The server must reject abusive traffic by closing the connection.
  967. %Abusive traffic can come from the form of too many requests in a
  968. %given amount of time, or too many concurrent connections. Limits
  969. %must be subject to configuration. (RFC7230 6.4)
  970. %
  971. %close_inactive_connections(Config) ->
  972. %The server must close inactive connections. The timeout
  973. %must be subject to configuration. (RFC7230 6.5)
  974. %
  975. %@todo
  976. %The server must monitor connections for the close signal
  977. %and close the socket on its end accordingly. (RFC7230 6.5)
  978. %
  979. %@todo
  980. %A connection close may occur at any time. (RFC7230 6.5)
  981. %
  982. %ignore_requests_after_connection_close(Config) ->
  983. %The server must not process any request after sending or
  984. %receiving the "close" connection option. (RFC7230 6.6)
  985. %
  986. %@todo
  987. %The server must close the connection in stages to avoid the
  988. %TCP reset problem. The server starts by closing the write
  989. %side of the socket. The server then reads until it detects
  990. %the socket has been closed, until it can be certain its
  991. %last response has been received by the client, or until
  992. %a close or timeout occurs. The server then fully close the
  993. %connection. (6.6)
  994. %
  995. %%% Routing.
  996. %
  997. %```
  998. %Host = authority ; same as authority-form
  999. %```
  1000. %
  1001. %reject_missing_host(Config) ->
  1002. %An HTTP/1.1 request that lacks a host header must be rejected with
  1003. %a 400 status code and the closing of the connection. (RFC7230 5.4)
  1004. %
  1005. %%% @todo http/1.0 missing_host(Config) ->
  1006. %An HTTP/1.0 request that lack a host header is valid. Behavior
  1007. %for these requests is configuration dependent. (RFC7230 5.5)
  1008. %
  1009. %reject_invalid_host(Config) ->
  1010. %A request with an invalid host header must be rejected with a
  1011. %400 status code and the closing of the connection. (RFC7230 5.4)
  1012. %
  1013. %reject_userinfo(Config) ->
  1014. %An authority component with a userinfo component (and its
  1015. %"@" delimiter) is invalid. The request must be rejected with
  1016. %a 400 status code and the closing of the connection. (RFC7230 2.7.1)
  1017. %
  1018. %reject_absolute_form_different_host(Config) ->
  1019. %When using absolute-form the URI authority component must be
  1020. %identical to the host header. Invalid requests must be rejected
  1021. %with a 400 status code and the closing of the connection. (RFC7230 5.4)
  1022. %
  1023. %reject_authority_form_different_host(Config) ->
  1024. %When using authority-form the URI authority component must be
  1025. %identical to the host header. Invalid requests must be rejected
  1026. %with a 400 status code and the closing of the connection.
  1027. %
  1028. %empty_host(Config) ->
  1029. %The host header is empty when the authority component is undefined. (RFC7230 5.4)
  1030. %
  1031. %@todo
  1032. %The effective request URI can be rebuilt by concatenating scheme,
  1033. %"://", authority, path and query components. (RFC7230 5.5)
  1034. %
  1035. %@todo
  1036. %Resources with identical URI except for the scheme component
  1037. %must be treated as different. (RFC7230 2.7.2)
  1038. %
  1039. %%% Response.
  1040. %
  1041. %@todo
  1042. %A server can send more than one response per request only when a
  1043. %1xx response is sent preceding the final response. (RFC7230 5.6)
  1044. %
  1045. %@todo
  1046. %A server that does parallel pipelining must send responses in the
  1047. %same order as the requests came in. (RFC7230 5.6)
  1048. %
  1049. %```
  1050. %HTTP-response = status-line *( header-field CRLF ) CRLF [ message-body ]
  1051. %```
  1052. %
  1053. %@todo
  1054. %The response format must be followed strictly.
  1055. %
  1056. %```
  1057. %status-line = HTTP-version SP status-code SP reason-phrase CRLF
  1058. %status-code = 3DIGIT
  1059. %reason-phrase = *( HTAB / SP / VCHAR / obs-text )
  1060. %```
  1061. %
  1062. %http10_request_http11_response(Config) ->
  1063. %A server must send its own version. (RFC7230 2.6)
  1064. %
  1065. %@todo
  1066. %An HTTP/1.1 server may send an HTTP/1.0 version for compatibility purposes. (RFC7230 2.6)
  1067. %
  1068. %@todo
  1069. %RFC6585 defines additional status code a server can use to reject
  1070. %messages. (RFC7230 9.3, RFC6585)
  1071. %
  1072. %%% Response headers.
  1073. %
  1074. %@todo
  1075. %In responses, OWS must be generated as SP or not generated
  1076. %at all. RWS must be generated as SP. BWS must not be
  1077. %generated. (RFC7230 3.2.3)
  1078. %
  1079. %```
  1080. %header-field = field-name ":" SP field-value
  1081. %
  1082. %field-name = token ; case-insensitive
  1083. %field-value = *( SP / %21-7E / %80-FF )
  1084. %```
  1085. %
  1086. %@todo
  1087. %In quoted-string found in field-value, quoted-pair must only be
  1088. %used for DQUOTE and backslash. (RFC7230 3.2.6)
  1089. %
  1090. %@todo
  1091. %HTTP header values must use US-ASCII encoding and must only send
  1092. %printable characters or SP. (RFC7230 3.2.4, RFC7230 9.4)
  1093. %
  1094. %@todo
  1095. %The server must not generate empty list elements in headers. (RFC7230 7)
  1096. %
  1097. %@todo
  1098. %When encoding an URI as part of a response, only characters that
  1099. %are reserved need to be percent-encoded. (RFC7230 2.7.3)
  1100. %
  1101. %special_set_cookie_handling(Config) ->
  1102. %The set-cookie header must be handled as a special case. There
  1103. %must be exactly one set-cookie header field per cookie. (RFC7230 3.2.2)
  1104. %
  1105. %@todo
  1106. %The server must list headers for or about the immediate connection
  1107. %in the connection header field. (RFC7230 6.1)
  1108. %
  1109. %@todo
  1110. %A server that does not support persistent connections must
  1111. %send "close" in every non-1xx response. (RFC7230 6.1)
  1112. %
  1113. %no_close_in_100_response(Config) ->
  1114. %no_close_in_101_response(Config) ->
  1115. %no_close_in_102_response(Config) ->
  1116. %A server must not send a "close" connection option
  1117. %in 1xx responses. (RFC7230 6.1)
  1118. %
  1119. %@todo
  1120. %The "close" connection must be sent in a message when the
  1121. %sender knows it will close the connection after fully sending
  1122. %the response. (RFC7230 6.6)
  1123. %
  1124. %@todo
  1125. %A server must close the connection after sending or
  1126. %receiving a "close" once the response has been sent. (RFC7230 6.6)
  1127. %
  1128. %close_request_close_response(Config) ->
  1129. %A server must send a "close" in a response to a request
  1130. %containing a "close". (RFC7230 6.6)
  1131. %
  1132. %%% Response body.
  1133. %
  1134. %no_body_in_head_response(Config) -> %% @todo test different ways to send a body in response
  1135. %Responses to HEAD requests never include a message body. (RFC7230 3.3)
  1136. %
  1137. %%% @todo Implement CONNECT
  1138. %2xx responses to CONNECT requests never include a message
  1139. %body. (RFC7230 3.3)
  1140. %
  1141. %no_body_in_100_response(Config) ->
  1142. %no_body_in_101_response(Config) ->
  1143. %no_body_in_102_response(Config) ->
  1144. %no_body_in_204_response(Config) ->
  1145. %no_body_in_304_response(Config) ->
  1146. %1xx, 204 and 304 responses never include a message body. (RFC7230 3.3)
  1147. %
  1148. %same_content_length_as_get_in_head_response(Config) ->
  1149. %same_transfer_encoding_as_get_in_head_response(Config) ->
  1150. %same_content_length_as_200_in_304_response(Config) ->
  1151. %same_transfer_encoding_as_200_in_304_response(Config) ->
  1152. %Responses to HEAD requests and 304 responses can include a
  1153. %content-length or transfer-encoding header. Their value must
  1154. %be the same as if the request was an unconditional GET. (RFC7230 3.3, RFC7230 3.3.1, RFC7230 3.3.2)
  1155. %
  1156. %no_transfer_encoding_in_100_response(Config) ->
  1157. %no_transfer_encoding_in_101_response(Config) ->
  1158. %no_transfer_encoding_in_102_response(Config) ->
  1159. %no_transfer_encoding_in_204_response(Config) ->
  1160. %%% @todo CONNECT no_transfer_encoding_in_2xx_response_to_connect_request(Config) ->
  1161. %no_content_length_in_100_response(Config) ->
  1162. %no_content_length_in_101_response(Config) ->
  1163. %no_content_length_in_102_response(Config) ->
  1164. %no_content_length_in_204_response(Config) ->
  1165. %%% @todo CONNECT no_content_length_in_2xx_response_to_connect_request(Config) ->
  1166. %1xx, 204 responses and "2xx responses to CONNECT requests" must
  1167. %not include a content-length or transfer-encoding header. (RFC7230 3.3.1, RFC7230 3.3.2)
  1168. %
  1169. %```
  1170. %message-body = *OCTET
  1171. %```
  1172. %
  1173. %The message body is the octets after decoding any transfer
  1174. %codings. (RFC7230 3.3)
  1175. %
  1176. %content_length_0_when_no_body(Config) ->
  1177. %content_length_response(Config) ->
  1178. %When the length is known in advance, the server must send a
  1179. %content-length header, including if the length is 0. (RFC7230 3.3.2, RFC7230 3.3.3)
  1180. %
  1181. %chunked_response(Config) ->
  1182. %When the length is not known in advance, the chunked transfer-encoding
  1183. %must be used. (RFC7230 3.3.2, RFC7230 3.3.3)
  1184. %
  1185. %compat_no_content_length_or_transfer_encoding_close_on_body_end(Config) ->
  1186. %For compatibility purposes a server can send no content-length or
  1187. %transfer-encoding header. In this case the connection must be
  1188. %closed after the response has been sent fully. (RFC7230 3.3.2, RFC7230 3.3.3)
  1189. %
  1190. %no_content_length_if_transfer_encoding(Config) ->
  1191. %The content-length header must not be sent when a transfer-encoding
  1192. %header already exists. (RFC7230 3.3.2)
  1193. %
  1194. %@todo
  1195. %The server must not apply the chunked transfer-encoding more than
  1196. %once. (RFC7230 3.3.1)
  1197. %
  1198. %@todo
  1199. %The server must apply the chunked transfer-encoding last. (RFC7230 3.3.1)
  1200. %
  1201. %http10_request_no_transfer_encoding_in_response(Config) ->
  1202. %The transfer-encoding header must not be sent in responses to
  1203. %HTTP/1.0 requests, or in responses that use the HTTP/1.0 version.
  1204. %No transfer codings must be applied in these cases. (RFC7230 3.3.1)
  1205. %
  1206. %```
  1207. %TE = #t-codings
  1208. %
  1209. %t-codings = "trailers" / ( transfer-coding [ t-ranking ] )
  1210. %t-ranking = OWS ";" OWS "q=" rank
  1211. %rank = ( "0" [ "." 0*3DIGIT ] ) / ( "1" [ "." 0*3("0") ] )
  1212. %```
  1213. %
  1214. %no_te_no_trailers(Config) ->
  1215. %te_trailers(Config) ->
  1216. %Trailers can only be sent if the request includes a TE header
  1217. %containing "trailers". (RFC7230 4.1.2)
  1218. %
  1219. %te_ignore_chunked(Config) ->
  1220. %te_ignore_chunked_0(Config) ->
  1221. %The presence of "chunked" in a TE header must be ignored as it
  1222. %is always acceptable with HTTP/1.1. (RFC7230 4.3)
  1223. %
  1224. %%% @todo te_not_acceptable_coding(Config) ->
  1225. %A qvalue of 0 in the TE header means "not acceptable". (RFC7230 4.3)
  1226. %
  1227. %@todo
  1228. %The lack of a TE header or an empty TE header means only "chunked"
  1229. %(with no trailers) or no transfer-encoding is acceptable. (RFC7230 4.3)
  1230. %
  1231. %ignore_te_if_not_in_connection_header(Config) ->
  1232. %The TE header must be listed in the connection header field,
  1233. %or must be ignored otherwise.
  1234. %
  1235. %@todo
  1236. %Trailer headers must be listed in the trailer header field value. (RFC7230 4.4)
  1237. %
  1238. %@todo
  1239. %When defined, the trailer header must also be listed in the connection header. (RFC7230 4.4)
  1240. %
  1241. %:: Upgrade
  1242. %
  1243. %```
  1244. %Upgrade = 1#protocol
  1245. %
  1246. %protocol = protocol-name ["/" protocol-version]
  1247. %protocol-name = token
  1248. %protocol-version = token
  1249. %```
  1250. %
  1251. %The upgrade header contains the list of protocols the
  1252. %client wishes to upgrade to, in order of preference. (RFC7230 6.7)
  1253. %
  1254. %upgrade_safely_ignored(Config) ->
  1255. %The upgrade header can be safely ignored. (RFC7230 6.7)
  1256. %
  1257. %upgrade_must_be_in_connection_header(Config) ->
  1258. %The upgrade header must be listed under the connection header,
  1259. %or must be ignored otherwise. (RFC7230 6.7)
  1260. %
  1261. %@todo
  1262. %A server accepting an upgrade request must send a 101 status
  1263. %code with a upgrade header listing the protocol(s) it upgrades
  1264. %to, in layer-ascending order. In addition the upgrade header
  1265. %must be listed in the connection header. (RFC7230 6.7)
  1266. %
  1267. %%A server must not switch to a protocol not listed in the
  1268. %%request's upgrade header. (RFC7230 6.7)
  1269. %
  1270. %@todo
  1271. %A server that sends a 426 status code must include a upgrade
  1272. %header listing acceptable protocols in order of preference. (RFC7230 6.7)
  1273. %
  1274. %@todo
  1275. %A server can send a upgrade header to any response to advertise
  1276. %its support for other protocols listed in order of preference. (RFC7230 6.7)
  1277. %
  1278. %@todo
  1279. %Immediately after a server responds with a 101 status code
  1280. %it must respond to the original request using the new protocol. (RFC7230 6.7)
  1281. %
  1282. %@todo
  1283. %%A server must not switch protocols unless the original message's
  1284. %%semantics can be honored by the new protocol. OPTIONS requests
  1285. %%can be honored by any protocol. (RFC7230 6.7)
  1286. %
  1287. %http10_ignore_upgrade_header(Config) ->
  1288. %A server must ignore an upgrade header received by an HTTP/1.0
  1289. %request. (RFC7230 6.7)
  1290. %
  1291. %expect_then_upgrade(Config) ->
  1292. %A server receiving both an upgrade header and an expect header
  1293. %containing "100-continue" must send a 100 response before the
  1294. %101 response. (RFC7230 6.7)
  1295. %
  1296. %The upgrade header field cannot be used for switching the
  1297. %connection protocol (e.g. TCP) or switching connections. (RFC7230 6.7)
  1298. %
  1299. %%% Compatibility.
  1300. %
  1301. %@todo
  1302. %A server can choose to be non-conformant to the specifications
  1303. %for the sake of compatibility. Such behavior can be enabled
  1304. %through configuration and/or software identification. (RFC7230 2.5)