NoScript+LiveHTTPHeaders+JS submit() causes 400 Bad Request
Posted: Mon Jan 17, 2011 9:14 pm
With Firefox 3.6.13 + NoScript 2.0.9.3 + LiveHTTPHeaders 0.16, an automatic
refresh of a page by issuing a POST request as described below results in 400
Bad Request after the Apache server times out reading the request. The problem
does not occur if either NoScript or LiveHTTPHeaders is deinstalled.
The HTML page that wants to refresh itself contains:
<body onload="timerID=setTimeout('document.mainform.submit()',60000);">
and:
<form method="post" enctype="multipart/form-data" accept-charset="utf-8"
action="https://....." name="mainform"> ..... </form>
The problem occurres only if this form is posted due to the timeout, but not if
it is posted by clicking on any submit button of the form.
If I click on the reload button (with or without the shift key held down) when
the 400 Bad Request is displayed, the error occures again.
I have hacked my Apache server to intercept the decrypted SSL data stream
(output of SSL_read() in modules/ssl/ssl_engine_io.c) into a file for
debugging.
Without LiveHTTPHeaders, the request data stream reads:
##### Begin of interception #####
POST /perMail/cgi/test/permail/1295218173 HTTP/1.1
Host: testxsso.uni-muenster.de
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.13) Gecko/20101206
Ubuntu/10.04 (lucid) Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://testxsso.uni-muenster.de/perMai ... 1295218112
X-Behavioral-Ad-Opt-Out: 1
X-Do-Not-Track: 1
Content-Type: multipart/form-data;
boundary=---------------------------8685874676609981101567304409
Content-Length: 4670
-----------------------------8685874676609981101567304409
Content-Disposition: form-data; name="what"
refr
-----------------------------8685874676609981101567304409
..... and all the other input fields .....
-----------------------------8685874676609981101567304409--
##### End of interception #####
With LiveHTTPHeaders, the request data stream reads:
##### Begin of interception #####
POST /perMail/cgi/test/permail/1295218471 HTTP/1.1
Host: testxsso.uni-muenster.de
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.13) Gecko/20101206
Ubuntu/10.04 (lucid) Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
X-Behavioral-Ad-Opt-Out: 1
X-Do-Not-Track: 1
Referer: https://testxsso.uni-muenster.de/perMai ... 1295218410
##### End of interception #####
As you can see, the Referer line gets moved down and the Content-Type and
Content-Length lines are missing. Also missing are the separator line and all
post data. This causes the Apache server to wait for the separator line until
timeout.
This problem does not occur e.g. when both NoScript and Firebug are installed.
Because Firebug intercepts HTTP headers as well, I assume that LiveHTTPHeaders
and not NoScript makes something wrong hooking itself into Firefox. But it might
be a NoScript bug nevertheless and thus I think you should know of the problem;
and perhaps you have a chance to circumvent it.
(I have posted the same information as bug report on
<https://www.mozdev.org/bugs/show_bug.cgi?id=23626>.)
Thanks for looking into it.
refresh of a page by issuing a POST request as described below results in 400
Bad Request after the Apache server times out reading the request. The problem
does not occur if either NoScript or LiveHTTPHeaders is deinstalled.
The HTML page that wants to refresh itself contains:
<body onload="timerID=setTimeout('document.mainform.submit()',60000);">
and:
<form method="post" enctype="multipart/form-data" accept-charset="utf-8"
action="https://....." name="mainform"> ..... </form>
The problem occurres only if this form is posted due to the timeout, but not if
it is posted by clicking on any submit button of the form.
If I click on the reload button (with or without the shift key held down) when
the 400 Bad Request is displayed, the error occures again.
I have hacked my Apache server to intercept the decrypted SSL data stream
(output of SSL_read() in modules/ssl/ssl_engine_io.c) into a file for
debugging.
Without LiveHTTPHeaders, the request data stream reads:
##### Begin of interception #####
POST /perMail/cgi/test/permail/1295218173 HTTP/1.1
Host: testxsso.uni-muenster.de
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.13) Gecko/20101206
Ubuntu/10.04 (lucid) Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://testxsso.uni-muenster.de/perMai ... 1295218112
X-Behavioral-Ad-Opt-Out: 1
X-Do-Not-Track: 1
Content-Type: multipart/form-data;
boundary=---------------------------8685874676609981101567304409
Content-Length: 4670
-----------------------------8685874676609981101567304409
Content-Disposition: form-data; name="what"
refr
-----------------------------8685874676609981101567304409
..... and all the other input fields .....
-----------------------------8685874676609981101567304409--
##### End of interception #####
With LiveHTTPHeaders, the request data stream reads:
##### Begin of interception #####
POST /perMail/cgi/test/permail/1295218471 HTTP/1.1
Host: testxsso.uni-muenster.de
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.13) Gecko/20101206
Ubuntu/10.04 (lucid) Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
X-Behavioral-Ad-Opt-Out: 1
X-Do-Not-Track: 1
Referer: https://testxsso.uni-muenster.de/perMai ... 1295218410
##### End of interception #####
As you can see, the Referer line gets moved down and the Content-Type and
Content-Length lines are missing. Also missing are the separator line and all
post data. This causes the Apache server to wait for the separator line until
timeout.
This problem does not occur e.g. when both NoScript and Firebug are installed.
Because Firebug intercepts HTTP headers as well, I assume that LiveHTTPHeaders
and not NoScript makes something wrong hooking itself into Firefox. But it might
be a NoScript bug nevertheless and thus I think you should know of the problem;
and perhaps you have a chance to circumvent it.
(I have posted the same information as bug report on
<https://www.mozdev.org/bugs/show_bug.cgi?id=23626>.)
Thanks for looking into it.