From 6aab4decde5735fc77daf4fecaf9ef3632189f62 Mon Sep 17 00:00:00 2001 From: Dustin Ingram Date: Thu, 14 May 2020 18:16:53 -0500 Subject: [PATCH] Add additional missing docs --- docs/source/settings.rst | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/source/settings.rst b/docs/source/settings.rst index 25119332..3b01f68f 100644 --- a/docs/source/settings.rst +++ b/docs/source/settings.rst @@ -1160,6 +1160,21 @@ The variables are passed to the the PasteDeploy entrypoint. Example:: .. versionadded:: 19.7 +.. _strip-header-spaces: + +strip_header_spaces +~~~~~~~~~~~~~~~~~~~ + +* ``--strip-header-spaces`` +* ``False`` + +Strip spaces present between the header name and the the ``:``. + +This is known to induce vulnerabilities and is not compliant with the HTTP/1.1 standard. +See https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn. + +Use with care and only if necessary. + Server Socket -------------