Fix handling of IPv6 literal hosts in Net::HTTPGenericRequest

[taketo1113]

Background

When an IPv6 literal URI is passed as uri_or_path to Net::HTTPGenericRequest, an issue in IPv6 handling causes the HTTP request header Host to become incorrect.
For example, it becomes ::1:8000 instead of [::1]:8000.

This incorrect Host header leads to the following problems:

• Fix IPv6 host addr causes URI::InvalidComponentError since uri v1.1.0 #235
  • Requests to http://[::1] result in an error with uri v1.0.4 - 1.1.0
• Fix Incorrect Host header for IPv6 addresses #73
  • An HTTP 400 Bad Request error occurs due to the malformed Host header

Details

This Pull Request fixes the handling of IPv6 literal hosts in Net::HTTPGenericRequest when a URI with an IPv6 literal is passed.
(This Pull Request revises and improves upon Pull Request #156.)

With this change, the Host header in HTTP requests generated from IPv6 literal URIs will now have the correct format.
Since this fix only resolves cases that previously caused HTTP 400 Bad Request errors, I think it does not introduce any compatibility issues.

• Before: Host: 2001:db8::1:8000
• After: Host: [2001:db8::1]:8000

The behavior for non-IPv6 literal URIs remains unchanged.

Expected behavior

• The Host header (req['Host']) returns an correct value
• No error occurs in Net::HTTPGenericRequest#update_uri with http://[::1]

require 'net/http'

# http://[2001:db8::1]:8000
req = Net::HTTP::Get.new(URI.parse("http://[2001:db8::1]:8000"))
req['Host']
#=> "[2001:db8::1]:8000"

req.update_uri("test", 8001, false)
req.uri.host
#=> "[2001:db8::1]"

# http://[::1]:8000
req = Net::HTTP::Get.new(URI.parse("http://[::1]:8000"))
req['Host']
#=> "[::1]:8000"

req.update_uri("example.com", 8001, false)
req.uri.host
#=> "[::1]"

Actual behavior

• The Host header (req['Host']) returns an incorrect value
• Net::HTTPGenericRequest#update_uri raises URI::InvalidComponentError with http://[::1] when using uri v1.0.4 - 1.1.0

require 'net/http'

# http://[2001:db8::1]:8000
req = Net::HTTP::Get.new(URI.parse("http://[2001:db8::1]:8000"))
req['Host']
#=> "2001:db8::1:8000"

req.update_uri("example.com", 8001, false)
req.uri.host
#=> "2001"

# http://[::1]:8000
req = Net::HTTP::Get.new(URI.parse("http://[::1]:8000"))
req['Host']
#=> "::1:8000"

req.update_uri("example.com", 8001, false)
/Users/taketo/path/ruby/3.4.0/gems/uri-1.1.0/lib/uri/http.rb:69:in 'URI::HTTP#check_host': bad component(expected host component):  (URI::InvalidComponentError)
	from /Users/taketo/path/ruby/3.4.0/gems/uri-1.1.0/lib/uri/generic.rb:653:in 'URI::Generic#host='
	from /Users/taketo/path/ruby/3.4.0/gems/net-http-0.7.0/lib/net/http/generic_request.rb:255:in 'Net::HTTPGenericRequest#update_uri'
...

System configuration

• ruby: 3.4.7
• net-http: 0.7.0
• uri: 1.1.0

Additional Information

The CI errors in test (2.7 / windows-latest) and test (2.6 / windows-latest) are unrelated to this fix and will be resolved once #236 is merged.
(It resolved by power_assert v3.0.1.)

[taketo1113]

Additional Information

The CI errors in test (2.7 / windows-latest) and test (2.6 / windows-latest) are unrelated to this fix and will be resolved once #236 is merged.

Since the cause of the CI errors has been resolved in power_assert v3.0.1, rerunning the CI should make the tests pass.

• Fix an issue where loading power_assert on CRuby 2.7 caused unintended errors power_assert#62

[HoneyryderChuck]

At this point you could just use https://docs.ruby-lang.org/en/master/URI/HTTP.html#method-i-authority ?

[taketo1113]

At this point you could just use https://docs.ruby-lang.org/en/master/URI/HTTP.html#method-i-authority ?

@HoneyryderChuck Thank you for the comment.

The URI::HTTP#authority method was added in Ruby 3.0, but since the net-http gem supports Ruby 2.6 and later, I don't think we can use it.

• [ruby/uri] URI#HTTP#origin and URI#HTTP#authority
  • ruby/ruby@553f234
• net-http: required_ruby_version
  • https://github.com/ruby/net-http/blob/master/net-http.gemspec#L24

spec.required_ruby_version = Gem::Requirement.new(">= 2.6.0")

[taketo1113]

@sorah Thank you for reviewing.

I've fixed the parts you pointed out in your comments.

Only the following caused errors with older versions of Ruby or the uri gem, so I kept the original implementation:
#237 (comment)

[sorah]

The URI::HTTP#authority method was added in Ruby 3.0, but since the net-http gem supports Ruby 2.6 and later, I don't think we can use it.

I agree raising minimum version to 3.0 as the present minimum version is too outdated. It's also worth to specify version to > 0.10.0.

[taketo1113]

I agree raising minimum version to 3.0 as the present minimum version is too outdated. It's also worth to specify version to > 0.10.0.

Should this Pull Request handle raising the minimum Ruby version?

Personally, since this Pull Request is a bug fix, I think it's better not to include breaking changes such as raising the minimum Ruby version.
Also, since the system Ruby on macOS 26 (released in September 2025) is still 2.6.10, I'd appreciate it if older Ruby versions could continue to be supported. (That said, Ruby 4.0 is coming soon, though…)

---

As for the CI errors, I believe they will pass if you rerun the workflow.
I tried running it several times in my forked repository, and all tests passed successfully.

• https://github.com/taketo1113/net-http/actions/runs/19216332542/job/54973767896

[sorah]

Should this Pull Request handle raising the minimum Ruby version?

Yes, that's definitely fine along with a fix requires newer Ruby version. However if URI 0.10.0 still supports Ruby 2.6, then specifying uri >= 0.10.0 as a dependency works sufficiently instead of raising minimum version.

[taketo1113]

Since uri was part of the standard library (before it was gemified) in Ruby 2.6, I have updated the minimum Ruby version to 2.7.
Also, since required_ruby_version for uri v0.11.0 is Ruby 2.4 or later, I have added a version constraint for the uri gem.

• https://github.com/ruby/uri/blob/v0.11.1/uri.gemspec#L18

The uri version is specified as uri > 0.11.0, because URI#parse without a scheme works from uri v0.11.1 or later.

@sorah Does the version constraint uri > 0.11.0 look reasonable?
If it’s too strict, I can relax it to uri >= 0.11.0.

• URI::HTTP#authority: uri >= v0.11.0
  • ruby/uri@bf13946c32
• URI#parse without scheme: uri >= v0.11.1
  • v0.11.0 does not work: Fix handling of IPv6 literal hosts in Net::HTTPGenericRequest #237 (comment)

require 'uri'
URI::VERSION
=> "0.11.1"

URI.parse("//[::1]")
=> #<URI::Generic //[::1]>

---

For reference, here are the uri gem versions included with each Ruby version:

Ruby	uri gem
3.2.0	0.12.0
3.1.4	0.12.1
3.1.0	0.11.0
3.0.0	0.10.1
2.7.0	0.10.0
2.6.0	-

https://stdgems.org/uri/

[sorah]

oops, then >= 0.11.1 to make it clear that we're relying on .1? any reasons to avoid >=?

[taketo1113]

oops, then >= 0.11.1 to make it clear that we're relying on .1? any reasons to avoid >=?

It's because URI#parse without a scheme works from uri v0.11.1 or later.
see: #237 (comment)

[taketo1113]

I misread it. I will change it to >=.

[taketo1113]

oops, then >= 0.11.1 to make it clear that we're relying on .1? any reasons to avoid >=?

@sorah I have fixed it.