Subject: Proxies and broken HTTP

From: Miles Sabin <[email-masked]>
Date: Fri, 10 Sep 1999 13:25:13 +0100

I'd be grateful for some advice on how the slogan
'applications should be liberal in what they receive and 
conservative in what they send' should be applied to
proxy servers.

The particular case I have in mind is an origin server
(which shall remain nameless) returning an entity body
with a 304. The client-side of our proxy is liberal 
enough to cope with this on receipt, but the server-
side conservatively refuses to forward it.

In this scenario it seems pretty reasonable to discard 
the entity: there's no way of reporting an error back
to the origin server, and it seems a bit extreme to send
the client a 502. But trying to generalize to other
kinds of upstream and downstream bad behaviour opens up 
a can of worms. The options seem to be,

1. Forward broken HTTP.

2. Enforce strict conformance by responding to all bad
   requests with 400s and all bad replies with 502s.

3. Fixup up bad requests/replies on their way through 
   wherever possible.

(1) is pretty much out of the question; (2) is over the
top; and (3) is completely unspecified, so liable to be
done differently be different proxy implementors.

What to do?

Cheers,

Miles

-- 
Miles Sabin                          Cromwell Media
Internet Systems Architect           5/6 Glenthorne Mews
+44 (0)181 410 2230                  London, W6 0LJ
[email-masked]           England

---

From: "Scott Lawrence" <[email-masked]>
Date: Fri, 10 Sep 1999 08:46:07 -0400

> the entity:

Sounds right to me.

> [...] But trying to generalize to other

I think that the only sensible thing to do is to figure each case out as
they arise; you've arrived at a good solution for this one, and it
sounds like you have it right - the server side is stricter than the
client side.

I would make sure that your log files include the Server: header for any
offending responses, so that proxy operators can complain effectivly to
vendors.  I assume that you've not kept silent to the (nameless) vendor
for this obvious bug.

--
Scott Lawrence           Director of R & D        <[email-masked]>
Agranat Systems, Inc.  Embedded Web Technology   http://www.agranat.com/