net/http/internal/http2: reject requests with conflicting "Host" and ":authority"

[nicholashusin]

Our HTTP/2 server implementation currently accepts requests with different value for Host and :authority.

Per RFC 9113, we should probably reject such requests:

Clients MUST NOT generate a request with a Host header field that differs from the ":authority" pseudo-header field. A server SHOULD treat a request as malformed if it contains a Host header field that identifies an entity that differs from the entity in the ":authority" pseudo-header field. The values of fields need to be normalized to compare them (see Section 6.2 of [RFC3986]). An origin server can apply any normalization method, whereas other servers MUST perform scheme-based normalization (see Section 6.2.3 of [RFC3986]) of the two fields.

[gabyhelp]

Related Issues

• net/http/internal/http2: remove "Host" header from Request.Header #80066
• net/http: HTTP/2 server accepts absolute URLs in :path pseudo-headers #78762 (closed)
• x/net/internal/http3: reject ":authority" with deprecated userinfo subcomponent when ":scheme" is "http" or "https" #79695
• net/http: document Request.Host value in HTTP/2 #34640 (closed)
• net/http: HTTP/1.1 requests without Host header should be rejected #13624 (closed)
• net/http: don't require Host header for "PRI * HTTP/2.0" requests #14451 (closed)
• x/net/http2: make Server reject conn-specific request headers #15087 (closed)
• x/net/http2: validate connection headers more #14214 (closed)
• net/http: HTTP/1.1 server does not reject empty Host header #77798 (closed)

Related Code Changes

• net/http: permit requests with invalid Host headers

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[kidnamedcudilovedrake-dot]

here we go again
weekly bunch of my dummy ideas about go issues !
Per RFC 9113, Section 8.3.1, a server should treat a request as malformed if it contains a Host header field that differs from the :authority pseudo-header field.

Here is a proposed implementation that validates :authority against the Host header (with case-insensitive and default-port scheme normalization). To preserve backward compatibility for non-compliant clients, a GODEBUG=http2serverrejectconflictinghost=0 setting is introduced to opt-out.

Proposed Changes

1. Declare the GODEBUG setting in src/net/http/server.go:

var http2serverrejectconflictinghost = godebug.New("http2serverrejectconflictinghost")

2. Add a helper function in src/net/http/h2_bundle.go to compare authority and host:

func http2compareAuthorityAndHost(authority, host, scheme string) bool {
	if authority == host {
		return true
	}
	return http2normalizeHost(authority, scheme) == http2normalizeHost(host, scheme)
}

func http2normalizeHost(h, scheme string) string {
	h = strings.ToLower(h)
	host, port, err := net.SplitHostPort(h)
	if err != nil {
		return h
	}
	if (scheme == "http" && port == "80") || (scheme == "https" && port == "443") {
		return host
	}
	return h
}

3. Perform validation during newWriterAndRequest in src/net/http/h2_bundle.go:

 	if rp.Authority == "" {
 		rp.Authority = header.Get("Host")
 	}
+	if rp.Authority != "" && header.Get("Host") != "" {
+		if http2serverrejectconflictinghost.Value() != "0" {
+			if !http2compareAuthorityAndHost(rp.Authority, header.Get("Host"), rp.Scheme) {
+				return nil, nil, sc.countError("conflicting_authority_host", http2streamError(f.StreamID, http2ErrCodeProtocol))
+			}
+		} else {
+			http2serverrejectconflictinghost.IncNonDefault()
+		}
+	}

[gopherbot]

Change https://go.dev/cl/792581 mentions this issue: http2: remove Host header from Request.Header and reject conflicting :authority

[ipezygj]

C:/Program Files/Git/claim - Will submit PR

[gopherbot]

Change https://go.dev/cl/813520 mentions this issue: http3, internal/httpcommon: improve :authority/host header interactions

[gopherbot]

Change https://go.dev/cl/813601 mentions this issue: net/http/internal/http2: improve :authority/host header interactions