Re: [jetty-users] Jetty 12 return wrong Host header?

[Silvio Bierman <sbierman@xxxxxxxxxxxxxxxxxx>]

    Greg,
    
    The requested info:
    
    Server receives this (pardon the brackets):
    
URL[https://demo.jambo.software/demo.jambo.software/s;x=13y762q065p53vl8nbmb4uf720]
    HEADER[sec-fetch-mode]=[cors]
    HEADER[content-length]=[26]
    HEADER[sec-fetch-site]=[same-origin]
    HEADER[accept-language]=[en-US,en;q=0.9]
HEADER[cookie]=[13y762q065p53vl8nbmb4uf720=A25F3449-F86C-4545-805E-45F947465397]
    HEADER[origin]=[https://demo.jambo.software]
    HEADER[Host]=[demo.jambo.software:8443]
    HEADER[accept]=[*/*]
    HEADER[sec-gpc]=[1]
    HEADER[sec-ch-ua]=["Not/A)Brand";v="99", "Brave";v="115",
    "Chromium";v="115"]
    HEADER[sec-ch-ua-mobile]=[?0]
    HEADER[sec-ch-ua-platform]=["Linux"]
    HEADER[content-type]=[application/vnd.piglet]
    HEADER[accept-encoding]=[gzip, deflate, br]
    HEADER[user-agent]=[Mozilla/5.0 (X11; Linux x86_64)
    AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0
    Safari/537.36]
    HEADER[sec-fetch-dest]=[empty]
    
    While the netword tab of the browser gives this for the request:
    
    Request
URL:https://demo.jambo.software/demo.jambo.software/s;x=13y762q065p53vl8nbmb4uf720
    Request Method:POST
    Status Code:200
    Remote Address:136.144.238.65:443
    Referrer Policy:no-referrer
    
    :authority:demo.jambo.software
    :method:POST
    :path:/demo.jambo.software/s;x=13y762q065p53vl8nbmb4uf720
    :scheme:https
    Accept:*/*
    Accept-Encoding:gzip, deflate, br
    Accept-Language:en-US,en;q=0.9
    Content-Length:26
    Content-Type:application/vnd.piglet
Cookie:13y762q065p53vl8nbmb4uf720=A25F3449-F86C-4545-805E-45F947465397
    Origin:https://demo.jambo.software
    Sec-Ch-Ua:"Not/A)Brand";v="99", "Brave";v="115", "Chromium";v="115"
    Sec-Ch-Ua-Mobile:?0
    Sec-Ch-Ua-Platform:"Linux"
    Sec-Fetch-Dest:empty
    Sec-Fetch-Mode:cors
    Sec-Fetch-Site:same-origin
    Sec-Gpc:1
    User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
    (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
    
    Cheers,
    
    Silvio

On 11-08-2023 15:27, Greg Wilkins wrote:

Silvio,

The host header should contain the host and port as used by the client. Thus if the request goes to the default port and is forward you a different port, the host header should not have the port in it, or at least only the default port.

Are you sure the client is using the default port and not going direct you the server?

Can you give us a bit more info: 

 + Uri and headers as sent by the client

 + Uri and headers as received by jetty

 + The actual values you get from the various request methods

Cheers

On Fri, Aug 11, 2023, 21:34 Silvio Bierman via jetty-users <jetty-users@xxxxxxxxxxx> wrote:

Hello all,

I have encountered what I think is a bug in Jetty 12 but I would like to
check here if that is actually true.

I use port forwarding to forward HTTP requests from port 443 to 8443.
Requests arrive at the default port without an explicit port number in
the URL so

request.getRequestURL().toString

does not show a port number. But

request.getHeader("Host")

returns the host name including the port number. This makes it
impossible to distinguish requests with explicit ports from requests
without these. Jetty 11 does not show this same behaviour.

Cheers,

Silvio

_______________________________________________
jetty-users mailing list
jetty-users@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/jetty-users