Skip to content

Capitalization in Custom HTTP Headers #85

Closed

Description

@n8c

It appears there is a bug when processing custom http headers. I'm feeding in a post file: -r post.txt

header contents include:
x-api-token: xyz123

When sqlmap generates the request the header is changed to:
X-Api-Token: xyz123

Our web server does not like this and we receive a 401.

Activity

  1. stamparm commented on Jul 13, 2012

    @stamparm
    Member

    From RFC 2616, "Hypertext Transfer Protocol -- HTTP/1.1", §4.2, "Message Headers":

    "Each header field consists of a name followed by a colon (":") and the field value. Field names are case-insensitive."
    

    Python does the capitalization as per given RFC standard. Maybe something else is wrong in your case.

  2. hagronnestad commented on Nov 19, 2013

    @hagronnestad

    I have this problem as well. RFC 2616 is nice and all, if every web application would follow it, but that's not the case. I would definitely prefer that the header case would be preserved the way I enter it.

    In my case AuthenticationToken becomes Authenticationtoken which the API won't accept.

  3. stamparm commented on Nov 24, 2013

    @stamparm
    Member

    Problem is that Python does the "capitalization" part. We'll need to make a dirty hack to bypass it

    p.s.

    http://bugs.python.org/issue2275
    https://groups.google.com/forum/#!topic/comp.lang.python/Ndl6s0EldKk

  4. added a commit that references this issue on Jan 2, 2014
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions