Request Line

The request-line is the first line of an HTTP request: method SP request-target SP HTTP-version CRLF. RFC 9112 Section 3 defines its grammar strictly. Malformed request-lines are a common vector for parser confusion.

The Rule

"Recipients of an invalid request-line SHOULD respond with either a 400 (Bad Request) error or a 301 (Moved Permanently) redirect with the request-target properly encoded." — RFC 9112 Section 3

Note this is a SHOULD, not a MUST. The RFC recommends 400 but does not mandate it — closing the connection is also acceptable.

Tests

MULTI-SP-REQUEST-LINE

Multiple spaces between method, target, and version.

Request-line with no request-target.

FRAGMENT-IN-TARGET

Fragment identifier (#) in request-target.

INVALID-VERSION

Unrecognized HTTP version string.

HTTP/0.9 style request with no version.

ASTERISK-WITH-GET

Asterisk-form (*) with non-OPTIONS method.

OPTIONS * — valid asterisk-form request.

Unknown Transfer-Encoding without CL.

CONNECT to an origin server must be rejected.

HEAD response must not contain a message body.

Unrecognized method should be rejected with 501 or 405.

405 response must include an Allow header.

OPTIONS response should include Allow header.

Unscored

Absolute-form request-target (http://host/).

Lowercase method 'get'. Methods are case-sensitive.

TRACE request — should be disabled in production.

Http11Probe — HTTP/1.1 compliance & smuggling testerSource on GitHub