You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cassandra.apache.org by "Bret McGuire (Jira)" <ji...@apache.org> on 2024/11/08 18:24:00 UTC
[jira] [Commented] (CASSJAVA-55) Reconsider setting "localhost" in CloudConfigFactory
[ https://issues.apache.org/jira/browse/CASSJAVA-55?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17896765#comment-17896765 ]
Bret McGuire commented on CASSJAVA-55:
--------------------------------------
This behaviour actually isn't specified in the Javadoc (or anywhere else) so it likely isn't uniform. But at least for OpenJDK it's the case; see [this impl|https://github.com/openjdk/jdk/blob/jdk-11%2B7/src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java] of URLConnection (for HTTPS URLs) for details. And it's presence in OpenJDK makes it significant enough to consider here.
> Reconsider setting "localhost" in CloudConfigFactory
> ----------------------------------------------------
>
> Key: CASSJAVA-55
> URL: https://issues.apache.org/jira/browse/CASSJAVA-55
> Project: Apache Cassandra Java driver
> Issue Type: Bug
> Components: Core
> Reporter: Bret McGuire
> Priority: Normal
>
> Current code for DataStax cloud attempts to set the "host" request property of the URLConnection that looks up metadata to "localhost" (see [here|https://github.com/apache/cassandra-java-driver/blob/4.18.1/core/src/main/java/com/datastax/oss/driver/internal/core/config/cloud/CloudConfigFactory.java#L232] for 4.x, [here|https://github.com/apache/cassandra-java-driver/blob/3.11.5/driver-core/src/main/java/com/datastax/driver/core/CloudConfigFactory.java#L209] for 3.x). This is passively problematic as in the common case attempts to set the Host header for URLConnection are ignored. But in some situations this can become actively problematic; the "sun.net.http.allowRestrictedHeaders" and/or "jdk.httpclient.allowRestrictedHeaders" actually _enable_ this operation to succeed. Upshot is that any downstream processing which relies on the Host header is now receiving unexpected data.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org