Skip to content

fix: Improve error message for HTTPS on HTTP port#12447

Closed
NIK-TIGER-BILL wants to merge 2 commits intoaio-libs:masterfrom
NIK-TIGER-BILL:fix/https-on-http-error-message
Closed

fix: Improve error message for HTTPS on HTTP port#12447
NIK-TIGER-BILL wants to merge 2 commits intoaio-libs:masterfrom
NIK-TIGER-BILL:fix/https-on-http-error-message

Conversation

@NIK-TIGER-BILL
Copy link
Copy Markdown

What do these changes do?

Improved the error message in HttpRequestParser when a client sends TLS handshake bytes (\x16\x03) to an HTTP port. Previously, this produced a generic Bad HTTP method error which was confusing for users. Now it raises a clear BadHttpMethod explaining that the client appears to be trying to connect via HTTPS to an HTTP port.

Are there changes in behavior for the user?

Yes — the error message for this very common misconfiguration is now self-explanatory. No API changes.

Is it a substantial burden for the maintainers to support this?

No. The change is a single early-exit check in the parser with an accompanying unit test.

Related issue number

Fixes #10142

Checklist

  • I think the code is well written
  • Unit tests for the changes exist
  • Documentation reflects the changes (news fragment added)
  • If you provide code modification, please add yourself to CONTRIBUTORS.txt
  • Add a new news fragment into the CHANGES/ folder

Detect TLS handshake bytes (\x16\x03) at the start of the request
and raise a descriptive BadHttpMethod error explaining that the client
appears to be trying to connect via HTTPS to an HTTP port.

Fixes aio-libs#10142

Signed-off-by: NIK-TIGER-BILL <nik.tiger.bill@github.com>
@psf-chronographer psf-chronographer Bot added the bot:chronographer:provided There is a change note present in this PR label May 3, 2026
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented May 3, 2026

Merging this PR will not alter performance

✅ 67 untouched benchmarks
⏩ 4 skipped benchmarks1


Comparing NIK-TIGER-BILL:fix/https-on-http-error-message (ac00148) with master (da50f24)

Open in CodSpeed

Footnotes

  1. 4 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports.

@codecov
Copy link
Copy Markdown

codecov Bot commented May 3, 2026

❌ 2 Tests Failed:

Tests completed Failed Passed Skipped
4524 2 4522 40
View the top 2 failed test(s) by shortest run time
tests.test_http_parser::test_http_request_parser_bad_method_https_on_http_port[py-parser-pyloop]
Stack Traces | 0.137s run time
parser = <aiohttp.http_parser.HttpRequestParser object at 0x7f995e554250>

    #x1B[0m#x1B[94mdef#x1B[39;49;00m#x1B[90m #x1B[39;49;00m#x1B[92mtest_http_request_parser_bad_method_https_on_http_port#x1B[39;49;00m(#x1B[90m#x1B[39;49;00m
        parser: HttpRequestParser,#x1B[90m#x1B[39;49;00m
    ) -> #x1B[94mNone#x1B[39;49;00m:#x1B[90m#x1B[39;49;00m
>       #x1B[94mwith#x1B[39;49;00m pytest.raises(http_exceptions.BadHttpMethod) #x1B[94mas#x1B[39;49;00m exc_info:#x1B[90m#x1B[39;49;00m
#x1B[1m#x1B[31mE       Failed: DID NOT RAISE <class 'aiohttp.http_exceptions.BadHttpMethod'>#x1B[0m

exc_info   = <ExceptionInfo for raises contextmanager>
parser     = <aiohttp.http_parser.HttpRequestParser object at 0x7f995e554250>

#x1B[1m#x1B[31mtests/test_http_parser.py#x1B[0m:1538: Failed
tests.test_http_parser::test_http_request_parser_bad_method_https_on_http_port[c-parser-pyloop]
Stack Traces | 0.142s run time
parser = <aiohttp._http_parser.HttpRequestParser object at 0x7f995f4bc7c0>

    #x1B[0m#x1B[94mdef#x1B[39;49;00m#x1B[90m #x1B[39;49;00m#x1B[92mtest_http_request_parser_bad_method_https_on_http_port#x1B[39;49;00m(#x1B[90m#x1B[39;49;00m
        parser: HttpRequestParser,#x1B[90m#x1B[39;49;00m
    ) -> #x1B[94mNone#x1B[39;49;00m:#x1B[90m#x1B[39;49;00m
        #x1B[94mwith#x1B[39;49;00m pytest.raises(http_exceptions.BadHttpMethod) #x1B[94mas#x1B[39;49;00m exc_info:#x1B[90m#x1B[39;49;00m
            parser.feed_data(#x1B[33mb#x1B[39;49;00m#x1B[33m"#x1B[39;49;00m#x1B[33m\x16#x1B[39;49;00m#x1B[33m\x03#x1B[39;49;00m#x1B[33m\x01#x1B[39;49;00m#x1B[33m\x00#x1B[39;49;00m#x1B[33m\xa5#x1B[39;49;00m#x1B[33m\x01#x1B[39;49;00m#x1B[33m\x00#x1B[39;49;00m#x1B[33m\x00#x1B[39;49;00m#x1B[33m\xa1#x1B[39;49;00m#x1B[33m\x03#x1B[39;49;00m#x1B[33m\x03#x1B[39;49;00m#x1B[33m"#x1B[39;49;00m)#x1B[90m#x1B[39;49;00m
>       #x1B[94massert#x1B[39;49;00m #x1B[33m"#x1B[39;49;00m#x1B[33mHTTPS#x1B[39;49;00m#x1B[33m"#x1B[39;49;00m #x1B[95min#x1B[39;49;00m #x1B[96mstr#x1B[39;49;00m(exc_info.value)#x1B[90m#x1B[39;49;00m
#x1B[1m#x1B[31mE       assert 'HTTPS' in "400, message:\n  Invalid method encountered:\n\n    b'\\x16\\x03\\x01'\n      ^"#x1B[0m
#x1B[1m#x1B[31mE        +  where "400, message:\n  Invalid method encountered:\n\n    b'\\x16\\x03\\x01'\n      ^" = str(<BadHttpMethod: 400, message="Invalid method encountered:\n\n  b'\\x16\\x03\\x01'\n    ^">)#x1B[0m
#x1B[1m#x1B[31mE        +    where <BadHttpMethod: 400, message="Invalid method encountered:\n\n  b'\\x16\\x03\\x01'\n    ^"> = <ExceptionInfo <BadHttpMethod: 400, message="Invalid method encountered:\n\n  b'\\x16\\x03\\x01'\n    ^"> tblen=2>.value#x1B[0m

exc_info   = <ExceptionInfo <BadHttpMethod: 400, message="Invalid method encountered:\n\n  b'\\x16\\x03\\x01'\n    ^"> tblen=2>
parser     = <aiohttp._http_parser.HttpRequestParser object at 0x7f995f4bc7c0>

#x1B[1m#x1B[31mtests/test_http_parser.py#x1B[0m:1540: AssertionError

To view more test analytics, go to the Test Analytics Dashboard
📋 Got 3 mins? Take this short survey to help us improve Test Analytics.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bot:chronographer:provided There is a change note present in this PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Change invalid error message when first two bytes of method begin with \x16\x03

2 participants