0

I want to use some restriction with SSL for now my .htacess is

RewriteEngine On 
RewriteCond %{HTTPS} !=on [OR] 
RewriteCond %{THE_REQUEST} ^POST(.*)HTTP/(0\.9|1\.0)$ [NC,OR]
RewriteCond %{REQUEST_METHOD} ^(delete|head|trace|track) [NC,OR]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R,L]

Edit

There are a lot of requests I can coming as HTTP1.0 and those are the requests that are trying to play with my forms so I want to restrict those as I read in a blog "there is more room for mischief with HTTP 1.0, primarily because the protocol does not require a Host header. Thus, another strategy for dealing with unwanted POST requests (and other types of requests, for that matter) is to require the HTTP 1.1 protocol."

I want the url to be always use SSL and also want to restrict requests from HTTP < 1.1. Why I have tried to explain below, please ask more question if I will try to describe my problem in better way.

Conceptually I would also like to understand in current time which version HTTP requests we should expect and how we can keep the post requests to be as expected ( want to block attacks ) .

5
  • 2
    What is the reason you want to do this in the first place, i.e. why should HTTP/1.0 clients not use HTTPS while HTTP/1.1 clients should? Apart from that, HTTP/2 clients will use HTTPS anyway since browsers only use HTTP/2 over TLS currently. May 18, 2017 at 21:46
  • @SteffenUllrich there are a lot of requests I can coming as HTTP1.0 and those are the requests that are trying to play with my forms so I want to restrict those as I read in a blog "there is more room for mischief with HTTP 1.0, primarily because the protocol does not require a Host header. Thus, another strategy for dealing with unwanted POST requests (and other types of requests, for that matter) is to require the HTTP 1.1 protocol." May 19, 2017 at 2:48
  • @SteffenUllrich thank you so much for your attention I was expecting you to reply, so that I can learn more :) May 19, 2017 at 2:49
  • 1
    First, please add any information needed to understand the question to the question itself and not inside the comment. Then, in my opinion the part you cite from the blog is wrong, but maybe I'm missing context. It would be good to add a link to this blog so one could get more context. Apart from that, based on your citation I would expect you to block HTTP/1.0 but you instead use the protocol version to find out what to redirect to HTTPS. Thus the reason you claim and the action you are trying to do don't fit together in my opinion. May 19, 2017 at 4:40
  • @SteffenUllrich I have edited my question with a link to the blog, thank you for your patience, please ask me more question if required to answer me. May 19, 2017 at 14:44

2 Answers 2

2

How can I restrict HTTP 1.0 or less using .htaccess?

I will not answer this question but I'm trying to explain why I think the idea of such restriction is wrong.

but there is more room for mischief with HTTP 1.0, primarily because the protocol does not require a Host header.

I very much doubt that statement. First, in the very common case that you are using VirtualHost you will not get any requests without Host header outside the default VirtualHost anyway - simply because the server cannot use the Host header to find which VirtualHost to use.

Apart from that a HTTP/1.0 request is mostly the same as a HTTP/1.1 request. In fact it's HTTP/1.1 which has more capabilities because you could also use Transfer-Encoding chunked in the request with HTTP/1.1, provided that the web server can deal with it.

More doubt about the competence of the author regarding the HTTP protocol is also the following suggested statement in the blog:

RewriteCond %{THE_REQUEST} ^POST(.*)HTTP/(0\.9|1\.0)$ [NC]

This way the author tries to match HTTP/1.0 and HTTP/0.9 request. But, with HTTP 0.9 (there is no HTTP/0.9, only HTTP 0.9) a request does not have any kind of version number so this statement will never match real HTTP 0.9 requests. See The Original HTTP as defined in 1991.

More useful are actually the tips on white listing only the requests you actually expect and denying everything else. And I would really recommend to deny unexpected ones, no matter if these came in with HTTP or HTTPS instead of only forwarding the "good" ones to HTTPS as you currently try to do.

0
1

You've got a few different requirements mixed together in there, and I'm not entirely convinced that you need to complicate it that much.

First, you want the URL to always be HTTPS - this is the purpose of the HTTP Strict Transport Security (HSTS) header. If sent as a header to a page served over HTTPS, all subsequent requests to the site from compliant clients will be over HTTPS. If you never get HTTP traffic to your site, you can also simply disable listening on port 80 (or whatever you have your HTTP server listening on). If you do get legitimate HTTP traffic, but want to transition it all to HTTPS, you can use rewrite rules or simple redirections to shift the traffic over, and then it'll be affected by the HSTS header for future requests. You'll also want to make sure you've adjusted any links and form submissions within your site to be relative, or to use protocol relative addresses.

An example of a suitable rule, which could be included in the VirtualHost listening on port 80, to do that would be:

Redirect permanent / https://secure.example.com/

Now you've got the HTTPS requirement sorted, so you can drop the .htaccess check for it, and stop trying to rewrite potentially malicious requests - making your .htaccess rules a simple blacklist, returning a 403 Forbidden status code (taken directly from the linked blog, with no attempt made to sanity check or validate):

<IfModule mod_rewrite.c>
    RewriteCond %{THE_REQUEST} ^POST(.*)HTTP/(0\.9|1\.0)$ [NC,OR]
    RewriteCond %{REQUEST_METHOD} ^(delete|head|trace|track) [NC]
    RewriteRule .* - [F,L]
</IfModule>

If you wanted to set the HSTS header in .htaccess, you could use:

Header always set Strict-Transport-Security "max-age=31536000"
1
  • I read both the answer quite sometime and some other answers on stack, I got another answer about it is here Can you let me know how env=HTTPS effects it and is there any way to restrict some HTTP verbs in a better way as you suggested for forced SSL ? May 22, 2017 at 3:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .