envoyproxy / envoyproxy/envoy

UHV/HeaderMap: Consider allowing users to validate Host and :authority headers separately

Open
#23,054 18 comments 0 reactions 0 assignees View on GitHub
enhancement no stalebot
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
437

Description

*Title*: UHV/HeaderMap: Consider allowing users to validate Host and :authority headers separately

*Description*:
This issue is filed as a follow-up to https://github.com/envoyproxy/envoy/pull/22537#discussion_r960009622, a discussion with @ameily and @yanavlasov. Based on this discussion, if receiving both a "host" and ":authority" header in HTTP/2, the current header map implementation merges the values into one comma-separated value. Then the Unified Header Validator (UHV) sees just the ":authority" header with the comma-separated value.

However, users may want to validate the "host" header and ":authority" header separately. The HTTP/2 specification states that if both are present, the values MUST agree ([link](https://www.rfc-editor.org/rfc/rfc9113.html#section-8.3.1-2.3.3)). Users may also want to be able to distinguish among the following scenarios:

```
Scenario A:
:authority: example.com
host: example.com

Scenario B:
:authority: example.com, example.com

Scenario C:
host: example.com, example.com
```

Furthermore, certain users of UHV may have other reasons for validating separately (e.g., custom long-standing behavior, even if apart from the current spec), so enabling separate validation would enable compatibility with these users.

*Relevant Links*:
- https://github.com/envoyproxy/envoy/pull/22537
- https://github.com/envoyproxy/envoy/issues/21308
- [HTTP/2 spec](https://www.rfc-editor.org/rfc/rfc9113.html#name-request-pseudo-header-field)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.