Skip to content

reject requests with more than one Host header field#3097

Open
sahvx655-wq wants to merge 1 commit into
boostorg:developfrom
sahvx655-wq:reject-duplicate-host
Open

reject requests with more than one Host header field#3097
sahvx655-wq wants to merge 1 commit into
boostorg:developfrom
sahvx655-wq:reject-duplicate-host

Conversation

@sahvx655-wq

Copy link
Copy Markdown
Contributor

basic_parser rejects a duplicate Content-Length but quietly accepts two Host header fields, which RFC 7230 5.4 forbids because a front-end and the back-end can then resolve the request to different authorities, a routing and cache-poisoning vector.

  1. do_field acts on Connection, Content-Length, Transfer-Encoding and Upgrade but never looked at Host, so a second Host was merged like any ordinary field.
  2. track it with a flagHost bit and fail the request with error::multiple_host on the second occurrence, request-side only so response parsing is unchanged.

@codecov

codecov Bot commented Jun 13, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 93.25%. Comparing base (736daa0) to head (3b69d98).

Files with missing lines Patch % Lines
include/boost/beast/http/impl/error.ipp 0.00% 1 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@             Coverage Diff             @@
##           develop    #3097      +/-   ##
===========================================
- Coverage    93.28%   93.25%   -0.04%     
===========================================
  Files          177      177              
  Lines        13750    13756       +6     
===========================================
+ Hits         12827    12828       +1     
- Misses         923      928       +5     
Files with missing lines Coverage Δ
include/boost/beast/http/basic_parser.hpp 94.11% <ø> (ø)
include/boost/beast/http/impl/basic_parser.ipp 97.24% <100.00%> (+0.03%) ⬆️
include/boost/beast/http/impl/error.ipp 93.87% <0.00%> (-1.96%) ⬇️

... and 1 file with indirect coverage changes


Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 736daa0...3b69d98. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant