<story><title>Post Mortem: A single whitespace character</title><url>http://eatabit.com/blog/articles/post-mortem-a-single-whitespace-char.html</url></story><parent_chain><item><author>jrochkind1</author><text>This very example -- requests were technically illegal all the time without devs realizing, but something in the stack changed to start rejecting them -- demonstrates the fallacy of the &amp;quot;be liberal in what you accept, strict in what you issue&amp;quot; principal.  If all the web servers involved had been strict in rejecting the illegal request from the start, they would have noticed the bug in development before deploying to firmware in the field.</text></item></parent_chain><comment><author>Xylakant</author><text>I don&amp;#x27;t agree that &amp;quot;be liberal in what you accept, strict in what you issue&amp;quot; is a fallacy. The client actually failed to adhere to the &amp;quot;be strict in what you issue&amp;quot; principal, just as the Cowboy was not liberal in accepting. All software will sooner or later exhibit bugs or be stricter or more lenient about a standard.&lt;p&gt;I think the fallacy is to assume that once stuff works in production, only your changes can trigger a bug. There&amp;#x27;s way too much software involved in a standard webserver stack to assume anything about it. Any patch, any update to software or devices not under your control has the potential to break your stack. The thing the OP did was the right thing: Monitor, monitor, monitor.</text></comment>
<story><title>Post Mortem: A single whitespace character</title><url>http://eatabit.com/blog/articles/post-mortem-a-single-whitespace-char.html</url></story><parent_chain><item><author>jrochkind1</author><text>This very example -- requests were technically illegal all the time without devs realizing, but something in the stack changed to start rejecting them -- demonstrates the fallacy of the &amp;quot;be liberal in what you accept, strict in what you issue&amp;quot; principal.  If all the web servers involved had been strict in rejecting the illegal request from the start, they would have noticed the bug in development before deploying to firmware in the field.</text></item></parent_chain><comment><author>codehero</author><text>I have to agree. I developed a proprietary embedded web server using a streaming HTTP parser. Complying with the HTTP parsing rules is a headache to say the least. Variable amounts of whitespace; 2 variants of line terminators (\r\n or \n) with the provision that the latter SHOULD be accepted by the server and line continuations make complying with the whole specification a real pain if you only have 100 bytes to parse pieces of your request.&lt;p&gt;Maybe for a server with massive resources (I am talking about megabytes of RAM compared to kilobytes I work with) being liberal in what you accept works, but not when you are on a budget.</text></comment>