akka / akka/akka-http

`X-Forwarded-Host` doesn't support setting a port

Open
#2,191 6 comments 0 reactions 0 assignees View on GitHub
1 - triaged t:core t:model
Dominant language
Scala
Stars
1.4k
Forks
584
Avg merge
14h 33m
Merged PRs (30d)
24

Description

According to the [`Forwarded` spec](https://tools.ietf.org/html/rfc7239#section-5.3):

> The syntax for a "host" value, after potential quoted-string
unescaping, MUST conform to the Host ABNF described in Section 5.4 of
[RFC7230].

Then, Mozilla's MDN [documents the `X-Forwarded-Host` syntax](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host) ambiguously. First is states:

> The X-Forwarded-Host (XFH) header is a de-facto standard header for identifying the original host requested by the client in the Host HTTP request header.

which seems to imply both `Host` and `X-Forwarded-Host` use the same syntax (as specified in [`Forwarded`](https://tools.ietf.org/html/rfc7239#section-5.3)). But then on the [`Syntax` section](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host#Syntax) it's specified as:

> X-Forwarded-Host: \

which is different from the [MDN spec for `Host`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Host#Syntax):

> Host: \:\

The [current implementation in Akka-HTTP](https://github.com/akka/akka-http/blob/9cf194694e0459ceec75e2c88cfcdd45864b8aa2/akka-http-core/src/main/scala/akka/http/scaladsl/model/headers/headers.scala#L1017-L1029) uses the `` syntax and cites the MDN page linked above (which can be interpreted in different ways).

`X-Forwarded-Host` is a _de facto_ standard so we could be debating forever. Per the [`Forwarded` spec](https://tools.ietf.org/html/rfc7239#section-5.3), I think `X-Forwarded-Host` should allow setting a port.

Contributor guide

Open the contributing guide

Research direction

Start in akka-http-core/src/main/scala/akka/http/scaladsl/model/headers/headers.scala at the X-Forwarded-Host implementation around lines 1017-1029. Compare its current host parsing with the RFC 7239 Host ABNF and the referenced MDN syntax. Done means X-Forwarded-Host accepts a host with a port while retaining valid host handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
scala
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.