dotnet / dotnet/aspnetcore

Incorrect HTTP/3 error code for malformed requests with invalid pseudo-header

Open
#55,712 3 comments 0 reactions 0 assignees View on GitHub
area-networking HTTP3
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

According to the [RFC 9114 HTTP/3](https://www.rfc-editor.org/rfc/rfc9114.html), We need to recognise a malformed request based on the criteria outlined in [section-4.1.2](https://www.rfc-editor.org/rfc/rfc9114.html#section-4.1.2) of the RFC:

> A malformed request or response is one that is an otherwise valid sequence of frames but is invalid due to:
>- the presence of prohibited fields or pseudo-header fields,
>- the absence of mandatory pseudo-header fields,
>- invalid values for pseudo-header fields,
>- ...

Additionally, based on [section-4.1.2-4](https://www.rfc-editor.org/rfc/rfc9114.html#section-4.1.2-4) in the HTTP/3 RFC, we should handle malformed requests by sending an `H3_MESSAGE_ERROR` HTTP error code.

> Malformed requests or responses that are detected MUST be treated as a [stream error](https://www.rfc-editor.org/rfc/rfc9114.html#errors) of type [H3_MESSAGE_ERROR](https://www.rfc-editor.org/rfc/rfc9114.html#H3_MESSAGE_ERROR).

**I've found a few instances where we're treating these cases as `H3_GENERAL_PROTOCOL_ERROR`, which isn't quite right.**

One example is when there are **invalid values for pseudo-header fields**. For instance, if we receive an invalid `:authority` pseudo-header like `userinfo@abs.dfe` which includes a subdomain(violate [section-4.3.1-2.10.1](https://www.rfc-editor.org/rfc/rfc9114.html#section-4.3.1-2.10.1)), we should respond with an `H3_MESSAGE_ERROR`. However, in the current implementation of Kestrel's HTTP/3, it returns a `H3_GENERAL_PROTOCOL_ERROR` instead in this [line](https://github.com/dotnet/aspnetcore/blob/1b454f57c664c1d43348c6c74cde7a2119813c8a/src/Servers/Kestrel/Core/src/Internal/Http3/Http3Stream.cs#L1114).

### Expected Behavior

_No response_

### Steps To Reproduce

_No response_

### Exceptions (if any)

_No response_

### .NET Version

_No response_

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.