In HTTP, is a query allowed when only giving a path as Request-URI?

Question

I am having a problem implementing a simple web server. According to the spec, a HTTP/1.1 request starts with this line:

Request-Line   = Method SP Request-URI SP HTTP-Version CRLF

In this line, there is a Request-URI which is defined as follows:

Request-URI    = "*" | absoluteURI | abs_path | authority

So, I am allowed to either send a complete URI (with schema, server name, etc) or an abs_path (authority is, as defined in the spec, only for the CONNECT method). Then I have:

abs_path      = "/"  path_segments
path_segments = segment *( "/" segment )

These definitions are from the URI spec, which is linked in the HTTP spec. As we see, abs_path is only an absolute path without the query.

So far the theory. Now when I actually send a HTTP GET request to http://example.com/?key=value, this line is sent:

GET /?key=value HTTP/1.1

I tried this using Firefox, Chrome and curl. Shouldn't that be illegal according to the spec? Am I overseeing something?

Answer 1

Your problem is that you're looking at an outdated version of the spec.

See https://www.greenbytes.de/tech/webdav/rfc7230.html#origin-form for the correct ABNF.

Answer 2

That is a known error in RFC 2616:

• Errata ID: 3056 and the corresponding fix: Changeset 76
• HTTP/1.1 Specification Errata: URI includes query / RFC2616bis Issues: URI includes query
• Errata: HTTP URL abs_path should include query

RFC 7230, which obsoletes RFC 2616, allows it. Its definition of request-line uses request-target (instead of Request-URI), which allows origin-form (instead of abs_path):

origin-form    = absolute-path [ "?" query ]