Subject: Host header vs host in absolute-URI

From: Adrien de Croy <[email-masked]>
Date: Sat, 18 Jul 2009 00:55:02 +1200

I raised this a while back but there was no real comment on it (that I saw).

I've been doing a bit more thinking on this.

The scenario that has me concerned is where there's a request in the 
form of an Absolute-URI to a proxy, but the host in the Absolute-URI 
doesn't match the host in the Host header.

When a proxy receives such a request, if it doesn't look for consistency 
between these 2 values, it would use the host in the URI, and connect to 
that, and send the original untouched Host header (denoting some other 
host and/or port than the one connected to).

This has several possible problems.

1. If the request is then intercepted by another proxy (not uncommon), 
it may only have the information (bogus) in the Host header to make a 
connection based on.
2. If the request goes to a server, the other host may also be hosted there.

This could end up only bypassing security, or worse.  Is this an 
opportunity for a XSS attack?

Do any browsers allow script to alter the host header in requests?

Should a proxy be concerned about this possibility?  If so, what should 
it do?

a) rewrite the Host header always with the host from the URI regardless.
b) bounce the request with a 400 if they don't match

or something else?

My preference would be b, but does that break any valid uses?

Regards

Adrien

-- 
Adrien de Croy - WinGate Proxy Server - http://www.wingate.com

---

From: Henrik Nordstrom <[email-masked]>
Date: Fri, 17 Jul 2009 20:34:55 +0200

> host and/or port than the one connected to).

That's a broken proxy. Proxies have to obey the client requirements just
as any other client, and sending out requests with a different Host
header than the host component of the Requested-URI is plain broken
(violating a MUST requirement).

When a proxy gets a request with mismatch between Host and Request-URI
it has two options:

a) Reject the request as malformed with 400 Bad Request

b) Drop the received Host header and add back one using the host
component from Request-URI, as if the received request was an HTTP/1.0
request without Host.

For simplicity I unconditionally do 'b' without even looking at the
received Host header.

> Do any browsers allow script to alter the host header in requests?

Very much doubt so.

> Should a proxy be concerned about this possibility?  If so, what should 

Yes.

> b) bounce the request with a 400 if they don't match

Pick the one you prefer.

> or something else?

Not that I know of. But then I haven't been verifying Host header
correctness ever... 

> My preference would be b, but does that break any valid uses?

It should not.

Regards
Henrik

---

From: Adrien de Croy <[email-masked]>
Date: Sat, 18 Jul 2009 15:38:16 +1200

Henrik Nordstrom wrote:
> That's a broken proxy. 
I agree it's broken however I can't find this MUST requirement.

or are you referring to p1 messaging s 5.1.2 para 6

"The most common form of request-target is that used to identify a
resource on an origin server or gateway. In this case the absolute
path of the URI MUST be transmitted (see Section 2.1.1, path-
absolute) as the request-target, and the network location of the URI
(authority) MUST be transmitted in a Host header field."

Regards

Adrien

> Proxies have to obey the client requirements just

---

From: Henrik Nordstrom <[email-masked]>
Date: Sat, 18 Jul 2009 08:04:16 +0200

> (authority) MUST be transmitted in a Host header field."

Yes, and there is also

8.4 Host

An HTTP/1.1 proxy MUST ensure that any request message it forwards does
contain an appropriate Host header field that identifies the service
being requested by the proxy.

and

5.2 The Resource Identified by a Request

If request-target is an absolute-URI, the host is part of the
request-target. Any Host header field value in the request MUST be
ignored.

Regards
Henrik