# SSL and HTTP 0.9

**URL:** <https://www.ruby-forum.com/t/ssl-and-http-0-9/121821>\
**Category:** NGINX\
**Created:** [December 1, 2007, 11:27am UTC](https://www.ruby-forum.com/t/ssl-and-http-0-9/121821 "2007-12-01T11:27:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Manlio\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/6f9a4e/32.png) [@Manlio\_P](https://www.ruby-forum.com/u/Manlio_P)\
**Post date:** [December 1, 2007, 11:27am UTC](https://www.ruby-forum.com/t/ssl-and-http-0-9/121821/1 "2007-12-01T11:27:56Z")

</div>

Hi.

An user (symlynX) on the nginx IRC channel at Freenode reported that an  
HTTPS server returns unencrypted pages when a plain HTTP 0.9 request is  
received.

He claims that this is a security problem, but I disagree (since when  
ssl\_verify\_client is enabled, nginx correctly returns an error), however  
I’m just curious to know why nginx behaves in this way.

Thanks Manlio P.

---

<div class="post-metadata">

**Author:** ![Manlio\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/6f9a4e/32.png) [@Manlio\_P](https://www.ruby-forum.com/u/Manlio_P)\
**Post date:** [December 1, 2007, 12:05pm UTC](https://www.ruby-forum.com/t/ssl-and-http-0-9/121821/2 "2007-12-01T12:05:57Z")

</div>

On Sat, Dec 01, 2007 at 11:15:47AM +0100, Manlio P. wrote:

> An user (symlynX) on the nginx IRC channel at Freenode reported that an  
> HTTPS server returns unencrypted pages when a plain HTTP 0.9 request is  
> received.
> 
> He claims that this is a security problem, but I disagree (since when  
> ssl\_verify\_client is enabled, nginx correctly returns an error), however  
> I’m just curious to know why nginx behaves in this way.

Yes, I do not consider it as security bug, it’s a usual bug.  
The attached patch that fixes it.

---

<div class="post-metadata">

**Author:** ![Manlio\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/6f9a4e/32.png) [@Manlio\_P](https://www.ruby-forum.com/u/Manlio_P)\
**Post date:** [December 1, 2007, 12:24pm UTC](https://www.ruby-forum.com/t/ssl-and-http-0-9/121821/3 "2007-12-01T12:24:39Z")

</div>

Igor S. ha scritto:

> Yes, I do not consider it as security bug, it’s a usual bug.  
> Ah, so its actually a bug :).

> The attached patch that fixes it.

Ok, tested.

Manlio P.