diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2020-06-02 15:59:14 +0300 |
|---|---|---|
| committer | Roman Arutyunyan <arut@nginx.com> | 2020-06-02 15:59:14 +0300 |
| commit | c0003539ac767ec9d16e54d26b5296a6669d0089 (patch) | |
| tree | b02c6277f6ad18c2e41c9ceeb351dc64a31593f9 /src/http/ngx_http_request.c | |
| parent | 0a11fdbb28d2efaaf2a541c321d4c5566bf1fbe5 (diff) | |
| download | nginx-c0003539ac767ec9d16e54d26b5296a6669d0089.tar.gz nginx-c0003539ac767ec9d16e54d26b5296a6669d0089.zip | |
Decoupled validation of Host and :authority for HTTP/2 and HTTP/3.
Previously an error was triggered for HTTP/2 when host with port was passed
by client.
Diffstat (limited to 'src/http/ngx_http_request.c')
| -rw-r--r-- | src/http/ngx_http_request.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c index 23b28c243..ac5937347 100644 --- a/src/http/ngx_http_request.c +++ b/src/http/ngx_http_request.c @@ -2065,10 +2065,18 @@ ngx_http_process_request_header(ngx_http_request_t *r) return NGX_ERROR; } - if (r->http_version >= NGX_HTTP_VERSION_20) { + if (r->headers_in.host == NULL && r->http_version == NGX_HTTP_VERSION_20) { + ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, + "client sent HTTP/2 request without " + "\":authority\" or \"Host\" header"); + ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); + return NGX_ERROR; + } + + if (r->http_version == NGX_HTTP_VERSION_30) { if (r->headers_in.server.len == 0) { ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, - "client sent HTTP request without " + "client sent HTTP/3 request without " "\":authority\" or \"Host\" header"); ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); return NGX_ERROR; @@ -2082,7 +2090,7 @@ ngx_http_process_request_header(ngx_http_request_t *r) != 0) { ngx_log_error(NGX_LOG_INFO, r->connection->log, 0, - "client sent HTTP request with different " + "client sent HTTP/3 request with different " "values of \":authority\" and \"Host\" headers"); ngx_http_finalize_request(r, NGX_HTTP_BAD_REQUEST); return NGX_ERROR; |