400 Bad request (spaces in request)

[Francis Daly]

On Fri, Jul 22, 2022 at 05:41:15AM -0400, sipopo wrote:

Hi there,

> nginx 1.21.1 started return 400 error if exists spaces in request. But I
> have old clients which need supports. Maybe anyone knows workaround?

spaces in urls have always been incorrect. Early nginx rejected them
as broken input; middle nginx was changed to allow most (but not all)
spaces, to give broken clients a chance to become fixed clients (which
in turn led to problem reports of the form "nginx accepts space G in
a url, but rejects space H"); new nginx rejects them again. The change
log lists the change as having happened in 1.21.1.

It appears that the "become fixed clients" part did not happen.

So for your use case for right now -- change back to something earlier
than 1.21.1.

Once that is working as much as it did previously, you have some time
in which you can choose between (as I see it):

* fixing your old clients (or links? It might depend how the broken urls
are created in the first place.)
* staying on the older nginx
* carrying your own patch to your newer nginx to handle spaces in the
way that you prefer
* getting a patch to allow a configuration choice on what to do with
spaces committed to stock nginx [+]
* using something other than nginx

[+] There is a reason why 1.21.1 rejected spaces. You will likely need
to convince someone that the benefits of having an option to change back
to the known-broken behaviour exceed the costs to them of doing that.

Good luck with it,

	f
-- 
Francis Daly        francis at daoine.org