graygnuorg / pound

Light-weight reverse proxy, load balancer and HTTPS front-end for Web servers.
GNU General Public License v3.0
43 stars 13 forks source link

Pound forwards messages containing unrecognized transfer codings #25

Closed kenballus closed 6 months ago

kenballus commented 8 months ago

Pound forwards unrecognized transfer codings. This is something that the standard recommends against. From RFC 9112, section 6.1:

A server that receives a request message with a transfer coding it does not understand SHOULD respond with 501 (Not Implemented).

While Pound's current behavior is not in violation of the RFCs, it's not particularly wise because some origin servers have strange interpretations of transfer codings. For example, there exist servers that interpret all unrecognized transfer codings as equivalent to chunked. This obviously pairs very poorly with Pound's policy of "forward all unknown transfer codings."

Nearly all other reverse proxies (including Akamai CDN, Apache httpd, Apache Traffic Server, Caddy, H2O, HAProxy, nghttpx, Nginx, Squid, Varnish, AWS CloudFront, Cloudflare CDN, Fastly, Google Cloud classic application load balancer, Google Cloud global application load balancer, and OpenBSD relayd) reject requests containing unrecognized transfer codings.