0

Questions like this and material like this provide lots of useful information about HTTP POST... but none that I have found clarifies the role of that second URL (or is it a URI, or something else, and is it even secondary?) in the very first line of the POST request header:

POST /second/url/here/ HTTP/1.1

The request itself is sent to a URL (URI?), which feels "primary" to me in some sense. Can someone please clarify the role of both, and why they would be the same or different as seems to be possible?

(P.S. it was probably once so obvious that nobody thought it might ever need explaining. But now when you google for "HTTP POST", half the internet appears, and it's near impossible to see the forest for the trees...)

Community
  • 1
  • 1
omatai
  • 2,701
  • 4
  • 37
  • 60

1 Answers1

1

I don't know hat is the 1st and the 2nd URL for you. I see only one. And it's not in the body but in the first line.

L01 POST /something?query=string HTTP/1.1\r\n
L02 Host: www.example.com\r\n
L03 Foo: here another header content\r\n
L04 Content-Length: 26\r\n
L05 \r\n
L06 This=is+the+body&arg=val\r\n

Let's analyze this from the bottom:

  • L06: this is the body, with a size of 26 octets, and containing some data, format of this body may be more complex, like being fom-url-encoded, gzipped, may contain some other \r and \n, etc. Depends on the list of headers.
  • L05: body separator
  • L04: one of the headers, with the size of the body
  • L03: another header (you can have plenty of headers)
  • L02: important header, the Host header must be used on HTTP version 1.1, to tell the server which Virtualhost you really want
  • L01: the first line.

The ** first line** is:

METHOD URL PROTOCOL

Where:

  • METHOD: is POST
  • URL: is /something?query=string, everything after the ? is the query string, which does not indicate a document (this is the job of the first part) but some extra parameters (the only one you can use with GET queries).
  • PROTOCOL: is HTTP/1.1, means you are talking with version 1.1 of the HTTP protocol
regilero
  • 27,883
  • 6
  • 54
  • 94
  • Sorry - "body" was a slip-up - clearly I meant "header" - fixed now. Still... there is another URL missing in what you have written, and what everyone seems to write (or a misunderstanding by me). That is, there is no way I can send this POST request to the URL you talk about - `/something`. It needs to be sent to `http://somewhere` or `https://somewhere`. That is another URL related to this POST request. I want to understand the relationship between these two URLs - requirements, limitations, etc. – omatai Feb 22 '16 at 21:42
  • 1
    `somewhere` is a domain (a DNS domain, which means there is an IP attached to this name). You need to send the request to this IP, on port 80 (or 443 for https). This IP could host several different domains, so you need to add the `Host: somewhere` header, to say it's for this domain. But on the first line you should not use the domain name (only the path on this domain, i.e. `/` or `/path/to/something`). – regilero Feb 24 '16 at 08:16
  • OK - that finally makes sense to me. I can't find the example where I thought I saw the domain repeated in the place where only the path should be (e.g. `POST http://here.com/somepath HTTP/1.1`)... but it's now clear that such a "full" specification is separated into the two components in question. – omatai Mar 02 '16 at 00:11
  • 1
    you are now ready to read this http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html – regilero Mar 02 '16 at 10:41