You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@arrow.apache.org by "crepererum (via GitHub)" <gi...@apache.org> on 2024/09/02 16:37:20 UTC
[I] S3 + HTTP/2: "duplicate" header [arrow-rs]
crepererum opened a new issue, #6352:
URL: https://github.com/apache/arrow-rs/issues/6352
**Describe the bug**
The bug occurs when S3 signatures are used in combination with HTTP/2. This (IIRC) is currently not possible with AWS S3, but some other vendors or custom implementation may run into this.
The combination produces the special `:authority:` HTTP/2 pseudo-header as well as the `Host` header. Some server or middleware implementation don't like that, e.g. Nginx will return a "bad request" and emit the log (here the host was `localhost:9999`:
```text
client sent duplicate host header: "host: localhost:9999", previous value: "host: localhost:9999" while reading client request headers, client: 127.0.0.1, server: , host: "localhost:9999"
```
Note that the header is not really duplicate. It's likely that Nginx internally renames `:authority` to `Host` and then trips over it. Also see https://trac.nginx.org/nginx/ticket/2268 .
**To Reproduce**
```rust
use object_store::{
aws::AmazonS3Builder,
ClientOptions,
};
let store = AmazonS3Builder::new()
.with_client_options(
ClientOptions::new()
.with_http2_only()
)
.with_region(...)
.with_access_key_id(...)
.with_secret_access_key(...)
.build()
.unwrap();
store.get(...).await.unwrap();
```
**Expected behavior**
<!--
A clear and concise description of what you expected to happen.
-->
**Additional context**
I think the culprit is this bit here:
https://github.com/apache/arrow-rs/blob/97ae9d778b5f1d1fcc0c7beb91b2b1a6ed741194/object_store/src/aws/credential.rs#L157-L159
Of course one could argue that `reqwest` or `h2` should de-duplicate the headers properly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] S3 + HTTP/2: "duplicate" header [arrow-rs]
Posted by "micolous (via GitHub)" <gi...@apache.org>.
micolous commented on issue #6352:
URL: https://github.com/apache/arrow-rs/issues/6352#issuecomment-2433864844
> Of course one could argue that `reqwest` or `h2` should de-duplicate the headers properly.
There was a [PR to automatically remove the host header on a library level](https://github.com/hyperium/h2/pull/679), but it was rejected because it is legal to send both the `Host` and `:authority` headers, and could because of a proxy forwarding a HTTP/1.1 request.
The spec just says they may not *differ*.
However, it is *unnecessary* for a client to send both headers.
It looks like it would be trivial for `arrow-rs` to fix this issue. 😄
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] S3 + HTTP/2: "duplicate" header [arrow-rs]
Posted by "Xuanwo (via GitHub)" <gi...@apache.org>.
Xuanwo commented on issue #6352:
URL: https://github.com/apache/arrow-rs/issues/6352#issuecomment-2325102889
Maybe related to https://github.com/seanmonstar/reqwest/issues/1809
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] S3 + HTTP/2: "duplicate" header [arrow-rs]
Posted by "alamb (via GitHub)" <gi...@apache.org>.
alamb commented on issue #6352:
URL: https://github.com/apache/arrow-rs/issues/6352#issuecomment-2741680983
Migrating from arrow-rs issue [#6352](https://github.com/apache/arrow-rs/issues/6352)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] S3 + HTTP/2: "duplicate" header [arrow-rs]
Posted by "Xuanwo (via GitHub)" <gi...@apache.org>.
Xuanwo commented on issue #6352:
URL: https://github.com/apache/arrow-rs/issues/6352#issuecomment-2434643135
Hi, I submitted this issue to `reqwest` and finally chose to implement a workaround in https://github.com/apache/opendal/pull/2956. Perhaps this will be helpful for object_store to adopt as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] S3 + HTTP/2: "duplicate" header [arrow-rs]
Posted by "crepererum (via GitHub)" <gi...@apache.org>.
crepererum commented on issue #6352:
URL: https://github.com/apache/arrow-rs/issues/6352#issuecomment-2434559051
So I would summarize this like this:
`object_store` operates within the spec, but the behavior is somewhat uncommon. Nginx rejects that behavior, even though it is explicitly allowed by the spec. Nginx also provides some evidence that `object_store` is somewhat weird, because many people use nginx w/ HTTP/2 and the bug on their side is still open, so this doesn't seem to be a super pressing issue for them.
We COULD make `object_store` more friendly (move it from uncommon to common behavior within the spec), but ultimately it's nginx that has to fix their stuff.
---
> There was a https://github.com/hyperium/h2/pull/679, but it was rejected because it is legal to send both the Host and :authority headers, and could because of a proxy forwarding a HTTP/1.1 request.
So if a HTTP/2 proxy has a HTTP/1.1 upstream does it not convert the pseudo header (`:authority:`) into its HTTP/1.1 counterpart (`Host`)? That seems like an oversight in the spec.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org