Join GitHub today
GitHub is home to over 36 million developers working together to host and review code, manage projects, and build software together.
Sign upnet/http: HTTP/1.1 requests without Host header should be rejected #13624
Comments
bradfitz
changed the title
HTTP/1.1 requests without Host header should be rejected
net/http: HTTP/1.1 requests without Host header should be rejected
Dec 15, 2015
bradfitz
self-assigned this
Dec 15, 2015
This comment has been minimized.
This comment has been minimized.
|
I noticed this too recently in the process of working on #11206 |
bradfitz
added this to the Go1.6 milestone
Dec 15, 2015
This comment has been minimized.
This comment has been minimized.
gopherbot
commented
Dec 16, 2015
|
CL https://golang.org/cl/17892 mentions this issue. |
bradfitz
closed this
in
6e11f45
Dec 16, 2015
calavera
referenced this issue
Mar 23, 2016
Closed
Pre-golang 1.6 Dockers can't talk to golang 1.6 Docker #20865
This was referenced Apr 4, 2016
This was referenced Apr 13, 2016
This comment has been minimized.
This comment has been minimized.
cgcgbcbc
commented
Jul 14, 2016
|
How to accept http 1.0 request then? |
This comment has been minimized.
This comment has been minimized.
|
@cgcgbcbc, HTTP/1.0 requests don't require Host headers. This bug only applies to HTTP/1.1 requests. |
golang
locked and limited conversation to collaborators
Jul 14, 2017
gopherbot
added
the
FrozenDueToAge
label
Jul 14, 2017
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
CAFxX commentedDec 15, 2015
HTTP/1.1 mandates (both in RFC2616 and RFC7230) that requests lacking a Host header should unconditionally receive a 400 Bad Request response.
https://tools.ietf.org/html/rfc2616#section-14.23
All Internet-based HTTP/1.1 servers MUST respond with a 400 (Bad Request)
status code to any HTTP/1.1 request message which lacks a Host header
field.
https://tools.ietf.org/html/rfc7230#section-5.4
A server MUST respond with a 400 (Bad Request) status code to any
HTTP/1.1 request message that lacks a Host header field and to any
request message that contains more than one Host header field or a
Host header field with an invalid field-value.
Right now Go happily accepts such requests without returning 400: as such it's non-conforming to the RFCs.