Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Request with HTTP_ACCEPT header of : */* #11704

Closed
fschwahn opened this issue Aug 1, 2013 · 4 comments
Closed

Request with HTTP_ACCEPT header of : */* #11704

fschwahn opened this issue Aug 1, 2013 · 4 comments

Comments

@fschwahn
Copy link
Contributor

fschwahn commented Aug 1, 2013

Hi,
my rails app threw an exception because of a ActionView::MissingTemplate-exception. This was because a request had a http header ACCEPT with the value : */*. The app couldn't find a template for this format (which is what I expect to happen). The user agent was set to Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36.

I'm curious about what this means. Is this a problem with rails, or a problem with my app? I'd like to now if : */* is an acceptable value for ACCEPT, and which browser would set it like that.

The app is using rails 3.2.13.

@steveklabnik
Copy link
Member

*/* is a valid value for the ACCEPT header, but I'm not sure where the bug is.

Could you try to reproduce this on 4.0 or master? I feel like we merged something related to this.

@fschwahn
Copy link
Contributor Author

fschwahn commented Aug 1, 2013

I'm sorry if I wasn't clear on this, the ACCEPT header is not */*, but : */*. In words: Colon Space Star Dash Star

Is this also a valid value? It is really hard to google this ;-)

@steveklabnik
Copy link
Member

http://tools.ietf.org/html/rfc2616#section-4.2

       message-header = field-name ":" [ field-value ]
       field-name     = token
       token          = 1*<any CHAR except CTLs or separators>

Nope, you must have at least one character before the colon.

@fschwahn
Copy link
Contributor Author

fschwahn commented Aug 1, 2013

Ok, I guess everything is alright then. I was a bit suspicious if somebody is trying to exploit some attack vector, but there seems to be nothing there.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants