You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The request-host is the name of the host, as known by the user agent,
to which the user agent is sending an HTTP request or from which it
is receiving an HTTP response (i.e., the name of the host to which it
sent the corresponding HTTP request).
The term request-uri is defined in Section 5.1.2 of [RFC2616].
According to https://tools.ietf.org/html/rfc6265#section-5.4 domain matching works on the request-host (with the unclear definition above).
The request-uri consists of the Host header and the abs_path, and the request-host sounds more like the r.URL.Host.
On the other hand: curl seems to use the Host header....
@vdobler What is the intended purpose of allowing outbound requests where r.Host != r.URL.Host?
When I issue outbound requests where r.Host != r.URL.Host, my intent is to mimic DNS resolution:
r.Host is what my user has in their address bar
r.URL.Host is where the DNS for r.Host resolves
Having this separation allows me to mimic a server that has multiple hosts pointed at it, and generate different responses depending on the Host.
Since I'm imagining r.Host is what my user has in their address bar, it's also where I'm expecting cookies to be set. But maybe I'm thinking about this all wrong?
Another exercise that might be helpful is to think about things from the server's perspective. r.URL.Host doesn't exist on the server, so when it issues SetCookie it expects the cookie to be set on the incoming request's r.Host.
I just ran into this issue. It seems pretty clear to me that a new *url.URL using r.Host should be used to set/get cookies.
Say my application does routing based on subdomain, and I'm testing with httptest.Server:
httptest.Server creates some url like http://localhost:21345.
I want any request to connect to localhost:21345, so to accomplish that I set r.URL = server.URL()
I still need to let the server know what domain is being requested, and so I set r.Host = "customer1.example.com"
The request is issued, and everything looks like it works fine. Except cookies are written with domain=.localhost instead of .customer1.example.com. This still appears to work for subsequent requests to customer1.exmaple.com.
When doing a subsequent request for customer2.example.com however, http.Clientstill loads cookies from localhost, and so all the cookies intended to be scoped to customer1.example.com are now being sent to customer2.example.com.
Currently the only workaround is to maintain your own cookiejar, and load/store the cookies before and after the request manually.
Is this something the net/http maintainers would welcome a patch for? What would fixing the behavior mean for the compatibility promise? It seems to me that leaking data from one domain to another is a clear security concern. It doesn't seem like this is something that would be pervasive in a production application.