Wstg: Review and fix HTTP POST request examples (4.5.1)

[rbsec]

There are a number of example POST requests in 4.5.1 (Testing for Credentials Transported over an Encrypted Channel), such as the one below:

POST http://www.example.com/homepage.do
Host: http://www.example.com/homepage.do
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.8.1.14) Gecko/20080404
Accept: text/xml,application/xml,application/xhtml+xml,text/html
Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.example.com/homepage.do
Cookie: SERVTIMSESSIONID=s2JyLkvDJ9ZhX3yr5BJ3DFLkdphH0QNSJ3VQB6pLhjkW6F
Content-Type: application/x-www-form-urlencoded
Content-length: 45

User=test&Pass=test&portal=ExamplePortal

There are a few things wrong with this:

• The first line is invalid (the protocol and hostname shouldn't be here, and it's missing the HTTP/1.1)
• The Host header is invalid (shouldn't have the protocol or the path)
• There's a lot of noise (useragent, encoding, charset, etc) that distracts from the important bits.

I'm sure there are similar issues elsewhere. I understand the intention is to make it clear that it's HTTP rather than HTTPS, but it's not good to be giving example requests that are completely invalid.

Perhaps this could be presented more simply as something like:

POST https://example.org/homepage.do

User=test&Pass=test&portal=ExamplePortal

Or if a few the headers are relevant:

POST https://example.org/homepage.do

Host: www.example.org
Foo: bar
[...]

User=test&Pass=test&portal=ExamplePortal

Thoughts?

[kingthorin]

Closer to option two would be my choice.

Include the method/verb in the code block, correct the host header, and provide some realistic/relevant header fields.

[ThunderSon]

Yeah, something like this:

POST /homepage.do HTTP/1.1
Host: example.org
Foo: bar
[...]

User=test&Pass=test&portal=ExamplePortal

Your examples had a mismatch between host and domain, but I'll let that go for now 😛

[ThunderSon]

Hmm, we'll need to set this under a milestone. How about we look at later versions, prior to releasing v5 maybe, or after getting over with the more critical versions, say till 4.3 the least?

[rbsec]

@ThunderSon the only issue with that approach is that it doesn't show the protocol. A lot of the time it's irrelevant, but in 4.5.1 (for example) it's talking about HTTP vs HTTPS in some of the issues, so there would need to be some thought about how to display that.

Also the Host header can probably be removed - unless it's relevant to the issue there's not much point having a Host header that points to an example domain. Most of the time I'd imagine you don't really need any headers.

[rbsec]

Also, if when a decision is made on how GET/POST requests should be shown, it might be worth updating the style guide with it.

[ThunderSon]

Valid point. Host is required in HTTP/1.1, so I'd prefer keeping it.

Good note about the style guide. @kingthorin we had a discussion on this same topic, guess we missed the bad examples and focused on some other semantics back then.

[rbsec]

@ThunderSon that's fair. Personally I tend to remove it when I report stuff as it's just noise, but I can see the value to keeping the requests valid.

[patrickceg]

Moved to https://github.com/OWASP/wstg/issues/419