Node.js · Senior · Question 33 of 75

Which HTTP-level issue should you protect a Node.js API from besides application bugs?

1Browsers sending too few headers
2Clients using HTTP/1.1
✓Correct answer: HTTP request smuggling and header abuse when proxies and Node parse requests differently; keep Node.js updated and don't disable strict parsing

Explanation

Node's HTTP parser (llhttp) is strict by default. Flags like --insecure-http-parser weaken that and should not be used in production.

Further reading

Test yourself

Take the Node.js · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.