8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190 #25844

jaikiran · 2025-06-17T06:55:38Z

Can I please get a review for this change which addresses a regression that was introduced in HttpURLConnection in Java 24 when we cleaned up the code by removing the references to SecurityManager APIs.

When a HTTP request is issued through java.net.HttpURLConnection, then the request URL is used to determine the Host header to set in the request. By default, the application cannot set a Host header to a different value. However the JDK allows a system property to be enabled to allow applications to explicitly set a Host request header when issuing the request.

Due to an oversight in the change that was done in https://bugs.openjdk.org/browse/JDK-8344190, the Host header that is set by the application, may not get used for that request causing this regression. Turns out we don't have tests in this area to catch this issue.

The commit in this PR fixes the regression and also introduces a new jtreg test which reproduces the issue and verifies the fix.

I've also checked the original change which introduced this regression #22232 to see if there's anything else that needs attention. I haven't stopped anything else.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190 (Bug - P2)

Reviewers

Volkan Yazici (@vy - Committer) Review applies to 6dc36858
Daniel Fuchs (@dfuch - Reviewer)
Daniel Jeliński (@djelinski - Reviewer)
Michael McMahon (@Michael-Mc-Mahon - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/25844/head:pull/25844
$ git checkout pull/25844

Update a local copy of the PR:
$ git checkout pull/25844
$ git pull https://git.openjdk.org/jdk.git pull/25844/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 25844

View PR using the GUI difftool:
$ git pr show -t 25844

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/25844.diff

Using Webrev

Link to Webrev Comment

…eader in some cases after JDK-8344190

bridgekeeper · 2025-06-17T06:56:25Z

👋 Welcome back jpai! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-06-17T06:57:18Z

@jaikiran This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190

Reviewed-by: dfuchs, djelinski, michaelm, vyazici

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 18 new commits pushed to the master branch:

2b94b70: 8359428: Test 'javax/swing/JTabbedPane/bug4499556.java' failed because after selecting one of L&F items, the test case automatically failed when clicking on L&F Menu button again
1130c1b: 6798061: The removal of System.out.println from KeyboardManager
2f63d3a: 7116990: (spec) Socket.connect(addr,timeout) not clear if IOException because of TCP timeout
... and 15 more: https://git.openjdk.org/jdk/compare/e55ddabffa90e28d22f546b387007fe4e434c3e0...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

openjdk · 2025-06-17T06:58:02Z

@jaikiran The following label will be automatically applied to this pull request:

net

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2025-06-17T07:00:45Z

Webrevs

vy · 2025-06-17T07:29:23Z

test/jdk/java/net/HttpURLConnection/HostHeaderTest.java

+    static void beforeAll() throws Exception {
+        final InetSocketAddress addr = new InetSocketAddress(InetAddress.getLoopbackAddress(), 0);
+        server = HttpServer.create(addr, 0);
+        server.createContext("/", new Handler());


I think it might be a good idea to salt the handler path a bit (e.g., with the class name) to avoid unexpected connections from tests running in parallel.

Hello Volkan, the server handler in this test is implemented to allow more than one request during its lifetime. So any unexpected requests from other processes would still allow this test to be unaffected by those requests. Did I misunderstand your suggestion for registering the handler to a test specific context?

So any unexpected requests from other processes would still allow this test to be unaffected by those requests.

Yes, this test will not be affected, but the other test might. Consider a test running in parallel, unexpectedly connecting to HostHeaderTest's server, and it is

either not expecting a response at all

or not expecting the response returned from the HostHeaderTest's handler

I've updated the PR to register the handler at a test specific context root. Having said that, I wasn't aware we were doing this in our tests.

We had some tests failing randmonly in the past because they got additional connections from other processes running on the same host (some time other tests). So now we tend to add a bit of salt in the path - it makes it easier to figure out that the strange things you see in the logs were not caused by a legit client. Also if you see 404 being returned and you know that your custom handler never returns 404 then it's easier to figure out that you somehow connected to some other server.

dfuch · 2025-06-17T13:28:07Z

src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java

            }
-            String reqHost = requests.findValue("Host");
-            if (reqHost == null || !reqHost.equalsIgnoreCase(host)) {
+            if (requests.findValue("Host") == null) {


Should we use setIfNotSet here like for "Accept" below?

That seems reasonable. I had a look at the implementation in setIfNotSet() and it matches this current semantic. So I've updated the PR to use setIfNotSet().

dfuch · 2025-06-17T14:13:36Z

test/jdk/java/net/HttpURLConnection/HostHeaderTest.java

 */
 class HostHeaderTest {

+    private static final String SERVER_CTX_ROOT = "/8359709";


Suggested change

private static final String SERVER_CTX_ROOT = "/8359709";

private static final String SERVER_CTX_ROOT = "/8359709/";

Preferably always terminate context roots with /

https://docs.oracle.com/en/java/javase/24/docs/api/jdk.httpserver/com/sun/net/httpserver/HttpServer.html#createContext(java.lang.String,com.sun.net.httpserver.HttpHandler)

API Note:
The path should generally, but is not required to, end with '/'. If the path does not end with '/', eg such as with "/foo" then this would match requests with a path of "/foobar" or "/foo/bar".

Good point. I've now updated the PR with this change. Test continues to pass.

…handler

jaikiran · 2025-06-18T08:25:56Z

Thank you all for the reviews. I'll go ahead and integrate this now.

Michael-Mc-Mahon · 2025-06-18T08:27:32Z

I'm trying to understand how this regression happened. I was looking at the code change for https://bugs.openjdk.org/browse/JDK-8344190 at https://openjdk.github.io/cr/?repo=jdk&pr=22232&range=01#sdiff-4-src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java and I can't see how it happened. The change looks pretty innocuous..?

Michael-Mc-Mahon · 2025-06-18T08:31:05Z

I'm trying to understand how this regression happened. I was looking at the code change for https://bugs.openjdk.org/browse/JDK-8344190 at https://openjdk.github.io/cr/?repo=jdk&pr=22232&range=01#sdiff-4-src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java and I can't see how it happened. The change looks pretty innocuous..?

Never mind. I see it's explained clearly in the bug report.

jaikiran · 2025-06-18T08:39:38Z

Hello Michael, I see that you already found out what caused the regression, but yes it's the if block check which went wrong in our clean up. The checkSetHost() method which was being used previously would always return true when SecurityManager wasn't set and that meant that we wouldn't enter the if block when the requestHost was non-null. That check broke after our clean up and is now fixed in this PR.

jaikiran · 2025-06-18T09:01:47Z

/integrate

openjdk · 2025-06-18T09:03:25Z

Going to push as commit 5726606.
Since your change was applied there have been 18 commits pushed to the master branch:

2b94b70: 8359428: Test 'javax/swing/JTabbedPane/bug4499556.java' failed because after selecting one of L&F items, the test case automatically failed when clicking on L&F Menu button again
1130c1b: 6798061: The removal of System.out.println from KeyboardManager
2f63d3a: 7116990: (spec) Socket.connect(addr,timeout) not clear if IOException because of TCP timeout
... and 15 more: https://git.openjdk.org/jdk/compare/e55ddabffa90e28d22f546b387007fe4e434c3e0...master

Your commit was automatically rebased without conflicts.

openjdk · 2025-06-18T09:03:32Z

@jaikiran Pushed as commit 5726606.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

jaikiran · 2025-06-18T09:11:09Z

/backport :jdk25

openjdk · 2025-06-18T09:12:45Z

@jaikiran the backport was successfully created on the branch backport-jaikiran-57266064-jdk25 in my personal fork of openjdk/jdk. To create a pull request with this backport targeting openjdk/jdk:jdk25, just click the following link:

➡️ Create pull request

The title of the pull request is automatically filled in correctly and below you find a suggestion for the pull request body:

Hi all,

This pull request contains a backport of commit 57266064 from the openjdk/jdk repository.

The commit being backported was authored by Jaikiran Pai on 18 Jun 2025 and was reviewed by Daniel Fuchs, Daniel Jeliński, Michael McMahon and Volkan Yazici.

Thanks!

If you need to update the source branch of the pull then run the following commands in a local clone of your personal fork of openjdk/jdk:

$ git fetch https://github.com/openjdk-bots/jdk.git backport-jaikiran-57266064-jdk25:backport-jaikiran-57266064-jdk25
$ git checkout backport-jaikiran-57266064-jdk25
# make changes
$ git add paths/to/changed/files
$ git commit --message 'Describe additional changes made'
$ git push https://github.com/openjdk-bots/jdk.git backport-jaikiran-57266064-jdk25

jaikiran added 2 commits June 17, 2025 11:38

8359709: introduce a test

8c5bc18

8359709: java.net.HttpURLConnection sends unexpected "Host" request h…

6dc3685

…eader in some cases after JDK-8344190

openjdk bot added the rfr Pull request is ready for review label Jun 17, 2025

openjdk bot added the net net-dev@openjdk.org label Jun 17, 2025

vy approved these changes Jun 17, 2025

View reviewed changes

dfuch reviewed Jun 17, 2025

View reviewed changes

jaikiran added 2 commits June 17, 2025 19:14

Daniel's suggestion - use setIfNotSet

5c65cc7

Volkan's suggestion - use test specific context root for the handler

666f29b

dfuch reviewed Jun 17, 2025

View reviewed changes

Daniel's suggestion - use trailing slash for path registered for the …

419e86b

…handler

dfuch approved these changes Jun 18, 2025

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Jun 18, 2025

djelinski approved these changes Jun 18, 2025

View reviewed changes

Michael-Mc-Mahon approved these changes Jun 18, 2025

View reviewed changes

openjdk bot added the integrated Pull request has been integrated label Jun 18, 2025

openjdk bot closed this Jun 18, 2025

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels Jun 18, 2025

jaikiran deleted the 8359709 branch June 18, 2025 09:05

jaikiran mentioned this pull request Jun 18, 2025

8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190 #25867

Closed

3 tasks

	private static final String SERVER_CTX_ROOT = "/8359709";
	private static final String SERVER_CTX_ROOT = "/8359709/";

8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190 #25844

8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190 #25844

Uh oh!

Conversation

jaikiran commented Jun 17, 2025 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issue

Reviewers

Reviewing

Uh oh!

bridgekeeper bot commented Jun 17, 2025

Uh oh!

openjdk bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openjdk bot commented Jun 17, 2025

Uh oh!

mlbridge bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

vy Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

jaikiran Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

vy Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

jaikiran Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

dfuch Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dfuch Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

jaikiran Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

dfuch Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jaikiran Jun 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jaikiran commented Jun 18, 2025

Uh oh!

Michael-Mc-Mahon commented Jun 18, 2025

Uh oh!

Michael-Mc-Mahon commented Jun 18, 2025

Uh oh!

jaikiran commented Jun 18, 2025

Uh oh!

jaikiran commented Jun 18, 2025

Uh oh!

openjdk bot commented Jun 18, 2025

Uh oh!

openjdk bot commented Jun 18, 2025

Uh oh!

jaikiran commented Jun 18, 2025

Uh oh!

openjdk bot commented Jun 18, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

jaikiran commented Jun 17, 2025 •

edited by openjdk bot

Loading

openjdk bot commented Jun 17, 2025 •

edited

Loading

mlbridge bot commented Jun 17, 2025 •

edited

Loading

dfuch Jun 17, 2025 •

edited

Loading

dfuch Jun 17, 2025 •

edited

Loading

jaikiran Jun 18, 2025 •

edited

Loading