HTTP/0.9 requests crash the server when `:debug t`

[fosskers]

Hi there.

Someone is sending HTTP/0.9 requests to my server, which crashes it. I found this function in woo where we can see that only HTTP 1.0 and 1.1 are supported. The function http-version-keyword is called within handle-request, which runs before my handlers ever do, so I'm not sure where I should put a handler-case in my own code (or if I even should). What are your thoughts? Thank you.

[fukamachi]

There's no specification for HTTP/0.9. Are you running Woo in debugging mode? If so, I recommend using it with :debug nil for production env.

[fosskers]

I found this: https://http.dev/0.9

I'm invoking woo like this:

(defun start-server (&key (address "127.0.0.1") (port 5000))
  "Start the Woo server."
  (let ((server (clack:clackup
                 (funcall lack/middleware/static:*lack-middleware-static*
                          (lambda (env) (funcall #'handler env))
                          :path "/static/"
                          :root #p"static/")
                 :server :woo
                 :address address
                 :port port
                 :use-default-middlewares nil)))
    (setf *server* server)))

Is :debug turned on by default? Yes it is. I'll try turning it off.

[fosskers]

Thanks to :debug nil, I now see:

 <CRIT> [20:33:32] woo - INVALID-HTTP-VERSION: major 0 minor 9

but the server doesn't crash. Thanks!

[fosskers]

Feel free to close this if you don't plan to add a code path for :HTTP/0.9 (etc.). My immediate issue was solved by turning off debug mode, and the server is still up despite receiving more HTTP/0.9 requests. Thanks again.

[fukamachi]

I'm closing for now. I'm also considering adding a warning message if it's running in debug mode, as this is a typical question.

[fukamachi]

Added a message in https://github.com/fukamachi/clack/commit/e8d97a68f7212edb193af0cd438b152db0c6f723.

[fosskers]

Thanks!