Subject: Host header with an empty value?

From: Zhong Yu <[email-masked]>
Date: Sat, 16 Mar 2013 11:26:15 -0500

Quoting http://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-22#section-5.4

   A client MUST send a Host header field in all HTTP/1.1 request
   messages.

   If the target URI includes an authority component, then
   the Host field-value MUST be identical to that authority component
   after excluding any userinfo (Section 2.7.1).

   If the authority
   component is missing or undefined for the target URI, then the Host
   header field MUST be sent with an empty field-value.

Can someone elaborate on the last sentence and give an example? Thanks.

Zhong Yu

---

From: Willy Tarreau <[email-masked]>
Date: Sat, 16 Mar 2013 17:43:37 +0100

> Can someone elaborate on the last sentence and give an example? Thanks.

It means that if the only thing you know is the path on the target server
and you have no idea about the host, then you must send the Host header
field anyway, but it must be left empty. For example, a load balancer
may send the following request to check that a server is alive or not,
whatever the virtual hosts installed on the server :

        GET /alive HTTP/1.1
        Host:

Regards,
Willy

---

From: Zhong Yu <[email-masked]>
Date: Sat, 16 Mar 2013 12:35:57 -0500

> whatever the virtual hosts installed on the server :

Is this really a legitimate HTTP request? We can't construct an HTTP
URL from it, so it's unclear what it is requesting.

Of course, the load balancer doesn't care about legality when it just
wants to do a ping. Then why not simply send a request *without* Host
header? Certainly the server will not crash because of that. The load
balancer should receive a 400 response.

Zhong Yu

---

From: Willy Tarreau <[email-masked]>
Date: Sat, 16 Mar 2013 19:15:28 +0100

On Sat, Mar 16, 2013 at 12:35:57PM -0500, Zhong Yu wrote:
> >         GET /alive HTTP/1.1
> >         Host:
> 
> Is this really a legitimate HTTP request?

I know at least one server which accepts it but does not accept a
request without "Host".

> We can't construct an HTTP

Ii depends. When all you need is direct connectivity (I mean an
address-agnostic request), http:///path/ could very well be valid.
For example when you connect over a local unix socket, you have no
ip nor address to indicate either in the request.

> balancer should receive a 400 response.

The server will return a 400 indicating an error instead of processing
it as a valid request.

You'll also note that on a number of web sites you can get the default
Host name when you only know the ip:port by sending such a request,
because they respond with a 301 redirect with the FQDN in the URL :-)

Willy

---

From: "Roy T. Fielding" <[email-masked]>
Date: Tue, 19 Mar 2013 10:44:52 -0700

> Can someone elaborate on the last sentence and give an example? Thanks.

HTTP can be used with any URI as a request target.  The sentence
tells the client what to do if that URI has no authority component.

  GET urn:ietf:rfc:2616.txt HTTP/1.1
  Host: 

Without that sentence, a reasonably sane person might conclude that
no Host header field would be sent, but that would result in a 400
error due to the IESG-imposed requirement in the first sentence.

....Roy

---

From: Zhong Yu <[email-masked]>
Date: Tue, 19 Mar 2013 14:08:22 -0500

Thanks Roy. So "Host" is not so much a mechanism for virtual hosting,
it's just one part of the URI (the other part is Request-URI).