You need *two* CRLFs to finish a request. You got away with one only because Apache and nginx have code in them to deal with clients that incorrectly implement the HTTP specification. (You also shouldn't specify full paths, but well, that's your only option here...)