How can I restrict HTTP 1.0 or less using .htaccess?

Question

I want to use some restriction with SSL for now my .htacess is

RewriteEngine On 
RewriteCond %{HTTPS} !=on [OR] 
RewriteCond %{THE_REQUEST} ^POST(.*)HTTP/(0\.9|1\.0)$ [NC,OR]
RewriteCond %{REQUEST_METHOD} ^(delete|head|trace|track) [NC,OR]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R,L]

Edit

There are a lot of requests I can coming as HTTP1.0 and those are the requests that are trying to play with my forms so I want to restrict those as I read in a blog "there is more room for mischief with HTTP 1.0, primarily because the protocol does not require a Host header. Thus, another strategy for dealing with unwanted POST requests (and other types of requests, for that matter) is to require the HTTP 1.1 protocol."

I want the url to be always use SSL and also want to restrict requests from HTTP < 1.1. Why I have tried to explain below, please ask more question if I will try to describe my problem in better way.

Conceptually I would also like to understand in current time which version HTTP requests we should expect and how we can keep the post requests to be as expected ( want to block attacks ) .

Answer 1

How can I restrict HTTP 1.0 or less using .htaccess?

I will not answer this question but I'm trying to explain why I think the idea of such restriction is wrong.

but there is more room for mischief with HTTP 1.0, primarily because the protocol does not require a Host header.

I very much doubt that statement. First, in the very common case that you are using VirtualHost you will not get any requests without Host header outside the default VirtualHost anyway - simply because the server cannot use the Host header to find which VirtualHost to use.

Apart from that a HTTP/1.0 request is mostly the same as a HTTP/1.1 request. In fact it's HTTP/1.1 which has more capabilities because you could also use Transfer-Encoding chunked in the request with HTTP/1.1, provided that the web server can deal with it.

More doubt about the competence of the author regarding the HTTP protocol is also the following suggested statement in the blog:

RewriteCond %{THE_REQUEST} ^POST(.*)HTTP/(0\.9|1\.0)$ [NC]

This way the author tries to match HTTP/1.0 and HTTP/0.9 request. But, with HTTP 0.9 (there is no HTTP/0.9, only HTTP 0.9) a request does not have any kind of version number so this statement will never match real HTTP 0.9 requests. See The Original HTTP as defined in 1991.

More useful are actually the tips on white listing only the requests you actually expect and denying everything else. And I would really recommend to deny unexpected ones, no matter if these came in with HTTP or HTTPS instead of only forwarding the "good" ones to HTTPS as you currently try to do.

Answer 2

You've got a few different requirements mixed together in there, and I'm not entirely convinced that you need to complicate it that much.

First, you want the URL to always be HTTPS - this is the purpose of the HTTP Strict Transport Security (HSTS) header. If sent as a header to a page served over HTTPS, all subsequent requests to the site from compliant clients will be over HTTPS. If you never get HTTP traffic to your site, you can also simply disable listening on port 80 (or whatever you have your HTTP server listening on). If you do get legitimate HTTP traffic, but want to transition it all to HTTPS, you can use rewrite rules or simple redirections to shift the traffic over, and then it'll be affected by the HSTS header for future requests. You'll also want to make sure you've adjusted any links and form submissions within your site to be relative, or to use protocol relative addresses.

An example of a suitable rule, which could be included in the VirtualHost listening on port 80, to do that would be:

Redirect permanent / https://secure.example.com/

Now you've got the HTTPS requirement sorted, so you can drop the .htaccess check for it, and stop trying to rewrite potentially malicious requests - making your .htaccess rules a simple blacklist, returning a 403 Forbidden status code (taken directly from the linked blog, with no attempt made to sanity check or validate):

<IfModule mod_rewrite.c>
    RewriteCond %{THE_REQUEST} ^POST(.*)HTTP/(0\.9|1\.0)$ [NC,OR]
    RewriteCond %{REQUEST_METHOD} ^(delete|head|trace|track) [NC]
    RewriteRule .* - [F,L]
</IfModule>

If you wanted to set the HSTS header in .htaccess, you could use:

Header always set Strict-Transport-Security "max-age=31536000"