jetty / jetty/jetty.project

Properly support HTTP/1.1 with non-http scheme absolute-uri and empty Host header

Open
#7,278 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Specification
Dominant language
Java
Stars
4.1k
Forks
2k
Avg merge
3d 56m
Merged PRs (30d)
48

Description

**Jetty version(s)**
9+

**Java version/vendor** `(use: java -version)`
All

**OS type/version**
All

**Description**
In the process of investigating the `HostHeaderCustomizer` in issue #7250 and the `HostPort` implementation in issue #7269 it was discovered
that our handling of empty `Host` header is wholly invalid and introduces a side effect on HTTP/1.1 requests that causes the exposure
of internal server ip to on requests forwarded through intermediaries as identified in issue #7277

Per the HTTP/1.1 spec section on `Host`
https://datatracker.ietf.org/doc/html/rfc7230#section-5.4

```
The "Host" header field in a request provides the host and port
information from the target URI, enabling the origin server to
distinguish among resources while servicing requests for multiple
host names on a single IP address.

Host = uri-host [ ":" port ] ; Section 2.7.1

A client MUST send a Host header field in all HTTP/1.1 request
messages. If the target URI includes an authority component, then a
client MUST send a field-value for Host that is identical to that
authority component, excluding any userinfo subcomponent and its "@"
delimiter (Section 2.7.1). If the authority component is missing or
undefined for the target URI, then a client MUST send a Host header
field with an empty field-value.
```

Basically, on HTTP/1.1 the rules for the `Host` header are ...

1. a `Host` header field MUST always be present
2. if the request uri path is absolute, then the `Host` header value MUST be the same as the absolute URI authority (even empty).
3. if the request uri path is relative, then the `Host` header value MUST be a valid authority with a defined "host" portion.

If you don't satisfy those requirements, the request results in a 400 Bad Request.

We do a good job on rule 1 already.
We fail rule 2.
However the above mentioned issues show we fail on rule 3.
The same above mentioned Issues will address rules 1 and 3, but this issue needs to address rule 2 separately.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the HTTP/1.1 Host rules in RFC 7230 section 5.4, then read the HostHeaderCustomizer and HostPort work referenced in issues #7250 and #7269. Trace handling of an absolute URI with a non-http scheme and an empty authority, and verify that the Host value follows the URI authority without exposing an internal server IP or incorrectly returning 400.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.