[servlet-dev] CONNECT and getRequestURI ?

[Greg Wilkins <gregw@xxxxxxxxxxx>]

All,

We have an issue with CONNECT requests being handled by servlets.   

Some security firms are routinely hitting public websites with CONNECT requests to probe for security vulnerabilities.

If the request lands on a HttpServlet that does not override service, then a method not supported response is sent.    But if a servlet overrides service, then what should the getRequestURI method return?

Internally we model a CONNECT request as a URI with authority, but no path.  Thus we are currently returning null from getRequestURI.  This is causing some NPEs (which turn into 500s) for some code that does not expect a null return from getRequestURI.

Currently the spec is mute about what to do if there is no path.  Should we just return empty string? or is null OK?

cheers

--

Greg Wilkins <gregw@xxxxxxxxxxx> CTO http://webtide.com