You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by "arturobernalg (via GitHub)" <gi...@apache.org> on 2026/02/16 15:41:00 UTC
[PR] HTTP/2: validate Host vs :authority [httpcomponents-core]
arturobernalg opened a new pull request, #622:
URL: https://github.com/apache/httpcomponents-core/pull/622
Clients MUST NOT generate a request with a Host header field that differs from the ":authority" pseudo-header field.”
“A server SHOULD treat a request as malformed if it contains a Host header field … that differs … from the … ":authority" pseudo-header field
https://datatracker.ietf.org/doc/html/rfc9113#name-request-pseudo-header-field
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] HTTP/2: validate Host vs :authority [httpcomponents-core]
Posted by "ok2c (via GitHub)" <gi...@apache.org>.
ok2c commented on code in PR #622:
URL: https://github.com/apache/httpcomponents-core/pull/622#discussion_r2813327968
##########
httpcore5-h2/src/main/java/org/apache/hc/core5/http2/protocol/H2RequestValidateHost.java:
##########
@@ -64,10 +71,57 @@ public void process(
final EntityDetails entity,
final HttpContext context) throws HttpException, IOException {
Args.notNull(context, "HTTP context");
+ Args.notNull(request, "HTTP request");
final ProtocolVersion ver = context.getProtocolVersion();
if (ver.getMajor() < 2) {
super.process(request, entity, context);
+ return;
}
+
+ final URIAuthority requestAuthority = request.getAuthority();
+ final Header hostHeader = request.getHeader(HttpHeaders.HOST);
+ if (hostHeader == null || requestAuthority == null) {
+ return;
+ }
+
+ final URIAuthority hostAuthority;
Review Comment:
> “A server SHOULD treat a request as malformed if it contains a Host header field … that differs … from the … ":authority" pseudo-header field"
@arturobernalg I read this if "differs at all". I would just do a text comparison without parsing the values.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: [PR] HTTP/2: validate Host vs :authority [httpcomponents-core]
Posted by "arturobernalg (via GitHub)" <gi...@apache.org>.
arturobernalg merged PR #622:
URL: https://github.com/apache/httpcomponents-core/pull/622
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org