Should we block HTTP range requests?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Should we block HTTP range requests?

L0 Member

I have found a few short discussions about how to block range requests, and an article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJsCAK.

 

My question is whether we should be blocking them because they present a threat.

 

My understanding is that an HTTP response is scanned in a single pass as it streams through the firewall, and that the most fundamental operation is looking for patterns within the content which indicate a problem with the content.  Is it therefore possible for a pattern to be split across the boundary between two HTTP range requests, and not detected?  Particularly since the range requests could be submitted multi-threaded, and therefore the later part of the file is actually processed before the earlier part?

 

Essentially: if a file is downloaded by a series of HTTP range requests, possibly not in the natural order, then are we guaranteed the same level of protection as if the file were downloaded using a single request?

 

Any links to definitive product documentation on this would be very welcome.

1 REPLY 1

Community Team Member

Hi @jonpmoore ,

 

Here is a relevant KB regarding HTTP range requests. In my opinion, if you aren't experiencing specific issues then it should be set to block. 

LIVEcommunity team member
Stay Secure,
Jay
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.
  • 1071 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!