Should we block HTTP range requests?

jonpmoore — Fri, 19 Apr 2024 10:37:41 GMT

I have found a few short discussions about how to block range requests, and an article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJsCAK.

My question is whether we should be blocking them because they present a threat.

My understanding is that an HTTP response is scanned in a single pass as it streams through the firewall, and that the most fundamental operation is looking for patterns within the content which indicate a problem with the content. Is it therefore possible for a pattern to be split across the boundary between two HTTP range requests, and not detected? Particularly since the range requests could be submitted multi-threaded, and therefore the later part of the file is actually processed before the earlier part?

Essentially: if a file is downloaded by a series of HTTP range requests, possibly not in the natural order, then are we guaranteed the same level of protection as if the file were downloaded using a single request?

Any links to definitive product documentation on this would be very welcome.

Re: Should we block HTTP range requests?

JayGolf — Wed, 24 Apr 2024 02:46:48 GMT

Hi @jonpmoore ,

Here is a relevant KB regarding HTTP range requests. In my opinion, if you aren't experiencing specific issues then it should be set to block.

topic Re: Should we block HTTP range requests? in Next-Generation Firewall Discussions

Should we block HTTP range requests?

Re: Should we block HTTP range requests?