How can Apache log whether requests are using HTTP2 or not, in a manner that can't be easily spoofed by the client?

Displayname71

10/8/23, 12:36 AM

According to this, including %H in your LogFormat is supposed to log the HTTP protocol version, however, it appears to be unreliable.

As an example, one can telnet to port 80 of the web server and issue a GET / HTTP/2.0, which will cause Apache to log it as HTTP/2.0, however, this is not valid HTTP2 traffic considering that HTTP2 is a binary protocol and can't (realistically) be executed by a human over telnet. It's easy to demonstrate that the aforementioned request is not actually handled by mod_http2 because nothing changes if the module is disabled, Apache will still process it and still misleadingly log it as if it were actually HTTP2.

Likewise, telnetting to port 80 and issuing a GET / HTTP/9.0 will cause Apache to log the request as HTTP/9.0 even though no such protocol exists.

I think what I really want to log is whether the traffic was actually handled by mod_http2 or not, as that information should come from Apache itself and not be vulnerable to client-side spoofing. Apache should know whether or not the traffic hit that module, but I haven't found a way to log based on that.

There doesn't seem to be anything relevant in the mod_http2 documentation

I am running Apache 2.4.41 on Ubuntu LTS 20.04.5

123

1 + 1

http

logging

apache-2.4

http2

apache2

ezra-s

10/8/23, 10:31 AM

It is how http protocol works, another thing is subsequent requests are not compliant with the spec you will get a 400 response (malformed request). Considering this I am not sure why you are concerned of client spoofing http protocol if they end up not sending malformed requests, or if you refer to uncomplete cases just like the one you mention, which will end up in 400 response and are really no concern.

Score:0

Server

A. Darwin

10/8/23, 12:31 PM

The HTTP version is specified as part of the HTTP header. Therefore, the HTTP version in an HTTP request is specified by the client in the HTTP request header.

Yes, someone could put an arbitrary value, but it should be irrelevant from a server point of view: either the proposed value is acceptable, which means the server will use it to reply (and if the client doesn't really support that, too bad for them!), or it is not acceptable, in which case the server should return a 505 error or similar.

+ 1

Displayname71

10/8/23, 6:57 PM

It seems a little more complex than that. If I telnet to port 80 of an Apache server, and issue a "GET / HTTP/2.0" along with a valid Host header, Apache will respond with a "HTTP/1.1 200 OK", because the request isn't real HTTP2 and isn't being processed by mod_http2, it's being treated as HTTP1.1. And yet Apache will incorrectly log it as HTTP2. This will happen even if mod_http2 is disabled.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How can Apache log whether requests are using HTTP2 or not, in a manner that can't be easily spoofed by the client?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.