Repository navigation
Reject request header blocks with neither :authority nor Host headers. #245
Description
RFC 7540 Section 8.1.2.3 has complex rules regarding :authority and Host headers, but the basic gist of it is that there is very nearly no situation when you can have neither of them. Basically the only way this could happen is if a HTTP/1.0 request with no Host header was proxied into a HTTP/2 request. I'm pretty disinterested in serving this use-case at this time, so I think we should forbid both sending and receiving header blocks of this form.
Activity
Lukasa commentedon Jun 29, 2016
For @python-hyper/contributors, if you want to tackle this, you'll want to write another stage in the
validate_headersheader filter pipeline defined inutilities.py. That'll work for received headers. Sending headers have a much smaller filter pipeline, but at this point we should probably define avalidate_sent_headersheader filter pipeline that takes the two current stages of the sent pipeline (_lowercase_header_namesandsecure_headers) and adds some more.This is a pretty good easy-to-intermediate task: it's a real problem that requires you to write real code, but it's pretty self-contained and easy enough to understand. If someone wants to work on it, assign it to yourself. Feel free to ask me to sketch out my proposed design in more detail.
alexwlchan commentedon Jul 8, 2016
I'm going to have a look at this today.
Lukasa commentedon Jul 8, 2016
\o/ Sounds good @alexwlchan, hit me up if you have questions!
Lukasa commentedon Jul 20, 2016
This is partly resolved by #252. We now only need to reject sending such blocks.
Lukasa commentedon Aug 11, 2016
Resolved.