Unsafe header parsing
Unsafe header parsing is an option you can turn on on your ASP.Net website (in the web.config) to allow the framework to parse responses. But what is an unsafe header ? It is a header in which the keys contains one or more spaces (that is not allowed in the HTTP 1.1 specifications).
The common case is having a space in the "content-length" header key. The server actually returns a "content length" key, which, assuming no spaces are allowed, is considered as an attack vector (HTTP response split attack), thus, triggering a "HTTP protocol violation error" exception.
To allow the parsing of unsafe headers, add the following to your web.config :
<system.net>
<settings>
<httpWebRequest useUnsafeHeaderParsing="true" />
</settings>
</system.net>
If you call a WebService, you must accept the HttpGet and/or HttpPost protocols in your web.config (they are disabled by default).
So add the following to your web.config file :
<configuration>
<system.web>
<webServices>
<protocols>
<add name="HttpGet"/>
<add name="HttpPost"/>
</protocols>
</webServices>
</system.web>
</configuration>
If you use Skype, make sure to uncheck the option for using port 80 and 443.
None of the above: find it yourself
If this has not helped, use the following links to help you find the answer :
Configure network tracing : http://msdn2.microsoft.com/en-us/library/ty48b824.aspx
Interpreting a network trace : http://msdn2.microsoft.com/en-us/library/46fcs6sz.aspx
No comments:
Post a Comment