2

I am currently debugging a surprising "Bad Request" response from an API.

Request:

POST /path HTTP/1.1
...

Response:

HTTP/1.1 421 Misdirected Request
Date: Fri, 30 Nov 2018 21:59:12 GMT
...
Via: https/1.1 subdomain.example.org (ApacheTrafficServer/7.1.4)
...

Per my research, HTTP status code 421 was only added with the http/2 specification. As you can see, my client is sending a HTTP1.1 request.

Does it make any sense to use it in the response to a HTTPS/1.1 request? What could it mean there?

Update: Further research indicates that this 421 response is triggered by an invalid CSRF token and Cookie value in the header, retrying the request with a verifiable valid combination returns the expected result with 200 OK. Unfortunately this doesn't really explain anything.

Community
  • 1
  • 1
janpio
  • 10,645
  • 16
  • 64
  • 107

1 Answers1

2

421 was added for HTTP/2 which allowed connection reuse. If a client reused a connection incorrectly (like Firefox used to) then the server should respond with this.

However that doesn’t mean it’s an HTTP/2 only status code. For example if a load balancer takes HTTP/2 requests in and passes them to back end servers over HTTP/1.1, then one of those backend servers can reject a request over HTTP/1.1 if it believes it was incorrectly sent that request. As you can see your request was sent via an Apache Traffic Server, so I suspect that is what happened here.

Barry Pollard
  • 40,655
  • 7
  • 76
  • 92
  • Thanks, good point. Though: The client is definitely not reusing any connection and sending HTTP/1.1 requests. Would it make sense for the Apache Traffic Server talking HTTP/2 and choosing the wrong server internally? – janpio Dec 01 '18 at 18:20
  • I'd thought the most common HTTP 1.1 use case (if it's indeed valid) is for unknown Host header values in a vhost environment. – OrangeDog Sep 17 '19 at 14:39
  • Possibly could be used for that but most servers just default to first vhost in this case and not sure they’d have the appetite to change this (at least by default). – Barry Pollard Sep 17 '19 at 15:36