A client too slow to send its request line is answered 400, not left without an answer #138

New Issue

2026-10-14T20:11:24+02:00

clawbot commented

2026-10-14 20:11:24 +02:00

A client whose request line is still unfinished when SWWAF_CLIENT_REQUEST_TIMEOUT runs out is answered 400 Bad Request. The README and SPEC.md say such a client gets no answer.

Repro, with the image of next at 6fcbda6 and SWWAF_CLIENT_REQUEST_TIMEOUT=5s: a client opens a connection, sends GET / HT and nothing more. After 5 seconds it receives HTTP/1.1 400 Bad Request and the connection is closed. A client that sends its whole request line and part of a header, then nothing, gets no answer after 5 seconds, as documented. Neither request has a line in the request log.

README, "Request log": headers slower than SWWAF_CLIENT_REQUEST_TIMEOUT, "whose connection it closes without an answer". SPEC.md, "Configuration surface", size and time limits: "A client that takes longer than SWWAF_CLIENT_REQUEST_TIMEOUT to send them gets no answer: the server closes its connection."

Go's server reads the request line with bufio.Reader.ReadLine, which returns the part of a line it has without the error when the read times out, so the cut line is parsed as the whole line and refused as malformed.

Severity: minor. Nothing reaches the app either way, and no ban or count follows; only the answer differs from the documents.

Model: opus-5-5

A client whose request line is still unfinished when `SWWAF_CLIENT_REQUEST_TIMEOUT` runs out is answered `400 Bad Request`. The README and SPEC.md say such a client gets no answer. Repro, with the image of `next` at `6fcbda6` and `SWWAF_CLIENT_REQUEST_TIMEOUT=5s`: a client opens a connection, sends `GET / HT` and nothing more. After 5 seconds it receives `HTTP/1.1 400 Bad Request` and the connection is closed. A client that sends its whole request line and part of a header, then nothing, gets no answer after 5 seconds, as documented. Neither request has a line in the request log. README, "Request log": headers slower than `SWWAF_CLIENT_REQUEST_TIMEOUT`, "whose connection it closes without an answer". SPEC.md, "Configuration surface", size and time limits: "A client that takes longer than `SWWAF_CLIENT_REQUEST_TIMEOUT` to send them gets no answer: the server closes its connection." Go's server reads the request line with `bufio.Reader.ReadLine`, which returns the part of a line it has without the error when the read times out, so the cut line is parsed as the whole line and refused as malformed. Severity: minor. Nothing reaches the app either way, and no ban or count follows; only the answer differs from the documents. Model: opus-5-5

clawbot referenced this issue

2026-10-14 20:12:12 +02:00

Run the image as an operator would, in front of a small test backend, and file the defects found #123

clawbot referenced this issue

2026-10-14 20:25:08 +02:00

1.0: what stands between next and a release candidate #140

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/smallwebwaf#138