8

To ask a question related to Are HTTP headers case-sensitive?, if HTTP methods are case sensitive, what do most servers do with a "get" or "post" vs a "GET" or "POST"?

For example, it looks like Apache httpd returns "501 Method Not Implemented" in response to lowercase methods, which is what I would expect.

wsanders
  • 187
  • 2
  • 7
  • 4
    Methods are indeed case-sensitive (https://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.1.1) – Oliver Charlesworth May 05 '18 at 16:44
  • 7
    @OliverCharlesworth rfc2616 is obsolete, https://tools.ietf.org/html/rfc7230#section-3.1.1 is the current text -- the point you made stands: methods are case-sensitive. – Frederik Deweerdt May 05 '18 at 17:35
  • Related: [HTTP method names: upper or lower case?](https://stackoverflow.com/q/27423615) – Pang Nov 05 '20 at 01:47
  • 2
    Is this question body answerable as written? It seems to request the behavior of "most servers" for conditions that are provably out of spec. Furthermore, the bounty requests an official reference for this undefined behavior, which seems to be either self-contradictory or a list of all major server implementations (and their chosen failure modes) to approximate the question's "most servers". – Jeff Bowman Mar 12 '21 at 23:10

2 Answers2

0

Most servers will:

  • Forward the case-insensitive method information to whatever application is handling it (for example PHP).
  • If they are handling the request themselves, they will return a 501.

This is true for Apache and Nginx, which I believe will already qualify as 'most'.

Evert
  • 75,014
  • 17
  • 95
  • 156
-1

The method token indicates the request method to be performed on the target resource. The request method is case-sensitive.

https://tools.ietf.org/html/rfc7230#section-3.1.1

The method token is case-sensitive because it might be used as a gateway to object-based systems with case-sensitive method names.

https://tools.ietf.org/html/rfc7231#section-4.1

What is interesting, is that while both references say the case is important, neither one says what case should be used. Continuing from the second reference:

By convention, standardized methods are defined in all-uppercase US-ASCII letters.

So now here it does say uppercase, but it also says by convention. So on paper, it would seem that you could also use all lower. In practice, it seems only upper is accepted:

PS C:\> curl.exe -X POST https://www.ietf.org
<!DOCTYPE html>
<html lang="en">
<head>
  <meta http-equiv="content-type" content="text/html; charset=utf-8">
  <meta name="robots" content="NONE,NOARCHIVE">
  <title>403 Forbidden</title>

PS C:\> curl.exe -X post https://www.ietf.org
<html>
<head><title>400 Bad Request</title></head>
Steven Penny
  • 82,115
  • 47
  • 308
  • 348
  • 1
    *Case-sensitive* just means that you have to use the name as specified, without changing the case. The method names are specified as `POST`, `GET`, and so on, so there's no ambiguity here. – Kevin Christopher Henry Mar 14 '21 at 04:41