Introduce KestrelServerOptions.AllowUnsafeHostHeaderOverride #48460
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
amcasey
requested review from
BrennanConroy,
JamesNK,
Tratcher,
halter73 and
mgravell
as code owners
amcasey
added
api-ready-for-review
|
Thank you for your API proposal. I'm removing the |
ghost
removed
the
api-ready-for-review
Tratcher
approved these changes
May 26, 2023
src/Servers/Kestrel/test/InMemory.FunctionalTests/BadHttpRequestTests.cs
Outdated
Show resolved
Hide resolved
src/Servers/Kestrel/test/InMemory.FunctionalTests/BadHttpRequestTests.cs
Outdated
Show resolved
Hide resolved
JamesNK
added
blocked
amcasey
added
area-networking
|
Looks like this PR hasn't been active for some time and the codebase could have been changed in the meantime. |
ghost
added
the
pending-ci-rerun
…ost (dotnet#39334) * Allow overriding the host header if doesn't match the absolute-form host * Apply suggestions from code review Co-authored-by: Stephen Halter <[email protected]>
The new public API is `KestrelServerOptions.AllowUnsafeHostHeaderOverride` and I've moved the explanatory comments there. The behavior remains opt-in.
|
Force push is a rebase |
Tratcher
approved these changes
Aug 1, 2023
Co-authored-by: Chris Ross <[email protected]>
amcasey
removed
blocked
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Introduce KestrelServerOptions.AllowUnsafeHostHeaderOverride
Make it possible to skip validation that the request-target and host header match.
Description
This builds on #48415 (which is itself a port of #39334). That PR introduced an internal API and corresponding appcontext switch that made it possible to overwrite an incorrect Host header with a value derived from an absolute-form request target to handle the surprisingly common client behavior of missing the line-break after the host header, as IIS/Http.Sys did. This PR upgrades it to a public API since those clients aren't going away. The behavior is the same, it just has a name and a doc comment intended for broader consumption.
Fixes #39335 (with #48415).
Fixes #48461