I'm writing a web server for fun, and I'm first adding support for HTTP/1.0. The primary reference I'm using is RFC 1945 => Hypertext Transfer Protocol -- HTTP/1.0.
In section 5.1 of the RFC, I learned that HTTP requests can be a single line, a GET method and a URI (e.g. GET /\r\n). The RFC refers to this as a Simple-Request.
In modern HTTP servers, are there any security risks associated with accepting, and responding to, a Simple-Request? If yes, what are the risks?
You could in theory accept any junk. But how do you want to respond to it? If the client sends HTTP 0.9 then you should not respond with HTTP/1.0 or HTTP/1.1 since such a client will likely not understand it. HTTP 0.9 means specifically no HTTP header in the response. This means lack of semantics to express things like Content-Type or Cookie. Given that most applications today relies on providing such information you also need to find ways to express the necessary semantics with such old clients which makes everything more complex.
Apart from that - HTTP is a complex enough protocol already (if properly implemented). Given that HTTP 0.9 is obsolete for more than 20 years and that there is no current and relevant client out there which still needs HTTP 0.9, you essentially add code which will never be needed for a practical purpose. This means that this code will be less tested than the rest and that the chance of critical bugs in this part of the code is much higher than in the rest. And while no relevant client will actually use HTTP 0.9 one can write a client which will do and which might make use of critical bugs inside this poorly tested code path.
In short: don't implement anything which is not needed. This way the code base is smaller and easier to test which results in more robust code. Anything which is not used in practice will result in rotten code which has no practical relevance except to cause trouble, for example by being a potential attack vector.
In theory, not really, you can simply handle HTTP/0.9 requests by internally converting it to an equivalent HTTP/1.1 request. So, if there's any vulnerability in the 0.9 version, the same is likely to exist in 1.1 as well.
In practice, the more things you implement, the more things you could've missed. For example, you may have applied a security rule that is applied on 1.1 connection, but due to flaws in the implementation, that rule isn't enforced correctly when 0.9 is used. For example, one possible problem with accepting HTTP/0.9 is with some misconfigurations it can be used to bypass virtual hosting rules, which may end up with a reverse proxy sending requests to the incorrect server or applying incorrect rules due to difference in how requests without a Host header is interpreted by the various layers in the system.
