Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net/http: Client and Transport don't support RFC 6874 #9544

Closed
mikioh opened this issue Jan 9, 2015 · 3 comments

Comments

Projects
None yet
2 participants
@mikioh
Copy link
Contributor

commented Jan 9, 2015

On all released versions, Get with a literal IPv6 address with a zone identifier fails. For example,

u := &url.URL{Scheme: "http", Host: "[::1%lo0]:8080"}
resp, err := http.DefaultClient.Get(u.String())

and

resp, err := http.Get("http://[::1%lo0]:8080")

return parse http://[::1%lo0]:8080: hexadecimal escape in host or parse [::1%lo0]:8080: invalid URL escape "%lo" error. After the fix of #6530, the former works well but the latter still fails.

@mikioh

This comment has been minimized.

Copy link
Contributor Author

commented Jan 9, 2015

In the latter case with the fix of #6530, the Host line of request headers is wrong.

Host: [::1%en0]:8080

On the wire, the line must be

Host: [::1%25en0]:8080
@mikioh

This comment has been minimized.

Copy link
Contributor Author

commented Jan 9, 2015

A correction. As per RFC 6874, the line must be

Host: [::1]:8080

The RFC says that an HTTP client, proxy, or other intermediary MUST remove any ZoneID attached to an outgoing URI, as it has only local significance at the sending host.

@mikioh mikioh closed this Jan 9, 2015

@mikioh mikioh reopened this Jan 9, 2015

@mikioh mikioh removed the release-none label Jan 14, 2015

@mikioh mikioh closed this in 957255f Apr 9, 2015

@mikioh mikioh added this to the Go1.5 milestone Apr 9, 2015

@gopherbot

This comment has been minimized.

Copy link

commented Aug 6, 2015

CL https://golang.org/cl/13296 mentions this issue.

gopherbot pushed a commit to golang/net that referenced this issue Aug 13, 2015

Mikio Hara
websocket: don't send IPv6 zone identifier in outbound request, per R…
…FC 6874

When making a request to an IPv6 address with a zone identifier, for
exmaple [fe80::1%en0], RFC 6874 says HTTP clients must remove the zone
identifier "%en0" before writing the request for security reason.

This change removes any IPv6 zone identifer attached to URI in the Host
header field in requests.

See golang/go#9544.

Change-Id: Ie5d18a0bc5f2768a95c59ec2b159ac0abdf685e8
Reviewed-on: https://go-review.googlesource.com/13296
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

@golang golang locked and limited conversation to collaborators Aug 5, 2016

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
You can’t perform that action at this time.