dotnet / dotnet/aspnetcore

Provide a default Host header when it's missing/empty

Open
#5,909 19 comments 1 reaction 0 assignees View on GitHub
affected-very-few area-hosting area-networking enhancement Needs: Design severity-nice-to-have
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

RE: https://github.com/Microsoft/ApplicationInsights-aspnetcore/issues/278

HTTP/1.0 requests do not provide Host headers, and HTTP/1.1 requests are required to provide it but it may be empty. This causes failures for components like loggers that want to describe the request with a Uri, or middleware that create absolute links like redirect-to-https. This is a protocol level problem that applies to supported servers.

Proposal: Hosting can provide a default host setting (from config) and apply it whenever the host header is missing or empty. This would happen right when the request is received and before any diagnostics take place:
https://github.com/aspnet/Hosting/blob/9f1e6607dd1b3d15bc6c42146629677c6b455fd0/src/Microsoft.AspNetCore.Hosting/Internal/HostingApplication.cs#L35-L37

*Updated proposal*
In the absence of config, inspect IServerAddresses for a url that matches the request scheme and port. The new Https redirect middleware does something similar:
https://github.com/aspnet/BasicMiddleware/blob/dd038387285bf9fa8dc52910ef762b9843ff22e4/src/Microsoft.AspNetCore.HttpsPolicy/HttpsRedirectionMiddleware.cs#L122-L139

Workarounds:
- The same logic could be applied via middleware but it wouldn't help these early diagnostic code paths.
- All consumers would need to be aware of the possibility of a missing host and provide some fallback logic. For loggers this isn't too bad, they could leave it out or substitute "unspecified", but redirect-to-https would have no default recourse.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.