Http11Probe

Long URL OK β€” HTTP/1.1 Compliance

Test ID COMP-LONG-URL-OK
Category Compliance
Scored Yes
RFC RFC 9112 Β§3
RFC Level SHOULD
Expected Any status except 414

What it sends

A GET request with a ~7900-character path (well under 8000 octets total for the request-line).

GET /aaaa...aaa HTTP/1.1\r\n
Host: localhost:8080\r\n
\r\n

The path contains 7900 repetitions of a.

What the RFC says

"A server that receives a request-target longer than any URI it wishes to parse MUST respond with a 414 (URI Too Long) status code." β€” RFC 9112 Β§3

"It is RECOMMENDED that all HTTP senders and recipients support, at a minimum, request-line lengths of 8000 octets." β€” RFC 9112 Β§3

Why it matters

Servers that reject URLs well within the 8000-octet recommendation may break legitimate applications that use long query strings or path parameters. This test verifies the server can handle a request-line just under the recommended minimum.

This is the inverse of MAL-LONG-URL, which tests rejection of extremely long URLs (~100KB). Together they verify a server has reasonable upper and lower bounds.

Verdicts

  • Pass β€” Server returns any status other than 414
  • Fail β€” Server returns 414 URI Too Long
  • Warn β€” Server closes the connection without a response

Sources

Http11Probe β€” HTTP/1.1 compliance & smuggling testerSource on GitHub