2

The folk in the QA department use visual studio team test (2008 IIRC) to run load tests against our web application.

The latest set of tests have failed on several pages. The error reported is

Request failed: The server committed a protocol violation. Section=ResponseHeader Detail=CR must be followed by LF

Searching for this using google yields quite a few results. it would appear that this error message is generated from the .Net framework WebRequest class (i.e. it is not a visual studio specific message). The most useful result is this one, which details my exact problem and how to suppress the error.

But of course, I want to get to the bottom of why this error occurs in the first place. Here are some more facts: -

  • This error never used to occur when the tests were run against an older version of the web app. The web app. host OS and web server (Win 2003 and IIS 6) are identical in both cases.
  • Not all the pages generate this error - only some.
  • The only significant change to these pages (that I can think of) is that they now use some AJAX whereas before they did not (IIRC)

In order to narrow down the problem, I created the simplest page that I could to replicate the problem. Luckily, that was not too hard. I then inspected the bytes in the header using Fiddler but I could not find an occurrence of a CR (0x0D) that was not followed by a LF (0x0A).

The raw HTTP response (as stored from Fiddler by response saving bytes - so its encoding should not have been altered during the save) is here as text if you don't believe me!

So now I am left thinking that the supposed error might be a false alarm. Does anyone else have experience of this/can help shed light?

Daniel Mann
  • 57,011
  • 13
  • 100
  • 120
Chris Fewtrell
  • 7,555
  • 8
  • 45
  • 63

1 Answers1

1

This is definitely not a false alarm - I've been getting this error in my app a lot while trying to communicate with Facebook API.

I've just stumbled upon this response from Steven Cheng - http://www.velocityreviews.com/forums/t302174-why-do-i-get-the-server-committed-a-protocol-violation.html - and let me quote him:

From your description, you're using the HttpWebRequest component to send some http request to some external web resource in your ASP.NET web application. However, you're always getting the "The server committed a protocol violation. Section=ResponseStatusLine" error unless you set the following section in the web.config file:

<system.net>
<settings>
<httpWebRequest useUnsafeHeaderParsing="true" />
</settings>
</system.net>

And you're wondering the cause of this behavior, correct?

As for this issue, I've performed some research on this and found that the problem is actually caused by the critical http header parsing/validating of the HttpWebRequest component. According to the Http Specification(http1.1), the HTTP header keys shoud specifically not include any spaces in their names. However, some web servers do not fully respect standards they're meant to. Applications running on the Dotnet framework and making heavy use of http requests usually use the httpWebRequest class, which encapsulates everything a web oriented developer could dream of. With all the recently issues related to security, the "httpWebRequest" class provides a self protection mechanism preventing it to accept HTTP answers which not fully qualify to the specifications.

The common case is having a space in the "content-length" header key. The server actually returns a "content length" key, which, assuming no spaces are allowed, is considered as an attack vector (HTTP response split attack), thus, triggering a "HTTP protocol violation error" exception.

Will try if this helps right now and post results later

nikib3ro
  • 20,366
  • 24
  • 120
  • 181