UHV/HeaderMap: Consider allowing users to validate Host and :authority headers separately
- Dominant language
- C++
- Stars
- 28.9k
- Forks
- 5.6k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 437
Description
*Title*: UHV/HeaderMap: Consider allowing users to validate Host and :authority headers separately
*Description*:
This issue is filed as a follow-up to https://github.com/envoyproxy/envoy/pull/22537#discussion_r960009622, a discussion with @ameily and @yanavlasov. Based on this discussion, if receiving both a "host" and ":authority" header in HTTP/2, the current header map implementation merges the values into one comma-separated value. Then the Unified Header Validator (UHV) sees just the ":authority" header with the comma-separated value.
However, users may want to validate the "host" header and ":authority" header separately. The HTTP/2 specification states that if both are present, the values MUST agree ([link](https://www.rfc-editor.org/rfc/rfc9113.html#section-8.3.1-2.3.3)). Users may also want to be able to distinguish among the following scenarios:
```
Scenario A:
:authority: example.com
host: example.com
Scenario B:
:authority: example.com, example.com
Scenario C:
host: example.com, example.com
```
Furthermore, certain users of UHV may have other reasons for validating separately (e.g., custom long-standing behavior, even if apart from the current spec), so enabling separate validation would enable compatibility with these users.
*Relevant Links*:
- https://github.com/envoyproxy/envoy/pull/22537
- https://github.com/envoyproxy/envoy/issues/21308
- [HTTP/2 spec](https://www.rfc-editor.org/rfc/rfc9113.html#name-request-pseudo-header-field)
Contributor guide
Assessment
This issue has not been assessed yet.