I cannot extract the TypedHeader<Host> using http2

[philippgl]

• I have looked for existing issues (including closed) about this

Bug Report

Version

24f8dc5 (head)

Platform

Linux lab-phgl 6.2.9-arch1-1 #1 SMP PREEMPT_DYNAMIC Thu, 30 Mar 2023 14:51:14 +0000 x86_64 GNU/Linux

Crates

Cargo.tom:

[package]
name = "example-bug"
version = "0.1.0"
edition = "2021"
publish = false

[dependencies]
axum = { path = "../../axum", features = ["headers", "http2" ] }
tokio = { version = "1.0", features = ["full"] }

Description

I cannot extract the host header (I have not tried other headers), if using http2. i needed to use --http2-prior-knowledge or https (using the axum-server crate).

curl --http2 --http2-prior-knowledge -v 'http://localhost:3000/'

works, but

curl --http2 --http2-prior-knowledge -v 'http://localhost:3000/host'

breaks.

I tried this code:

use std::net::SocketAddr;

use axum::{extract::TypedHeader, headers::Host, routing::get, Router};

#[tokio::main]
async fn main() {
    let app = Router::new()
        .route("/host", get(host_handler))
        .route("/", get(|| async { "static reply" }));
    let addr = SocketAddr::from(([127, 0, 0, 1], 3000));
    let server = axum::Server::bind(&addr);
    server.serve(app.into_make_service()).await.unwrap();
}

async fn host_handler(TypedHeader(host): TypedHeader<Host>) -> String {
    format!("connected to {}", host.hostname())
}

I expected to see this happen:

With the above curl command, I expect:

connected to localhost

(status 200)

Instead, this happened:

Header of type `host` was missing

(status 400)

[davidpdrsn]

I don't know enough about h2 to answer but I suppose it's an inherent thing in h2 and not a bug. Does https://docs.rs/axum/latest/axum/extract/struct.Host.html work?

If you need more help I suggest you ask in #hyper in the tokio discord.

[philippgl]

It works with the axum::extract::Host.

Thanks a lot.

"looking" at the source the if let Some(host) = parts.uri.host() matches, so that is good enough for me and certainly better than trying to write some AuthorityOrHost extractor. (neither host nor authority actually show up in the HeaderMap)

[philippgl]

Ooops. It only works partially. The behavior now differs between http and http2. With http I get the port appended and with http2 I do not. I will create a new issue.

[davidpdrsn]

Is that inherent to h2 and just how the protocol works?

[philippgl]

I assume, this is caused by the parts.uri.host(). If I do curl -v I can see "localhost:3000" in all the usual places (authority and Host):

*   Trying 127.0.0.1:3000...
* Connected to localhost (127.0.0.1) port 3000 (#0)
* h2h3 [:method: GET]
* h2h3 [:path: /]
* h2h3 [:scheme: http]
* h2h3 [:authority: localhost:3000]
* h2h3 [user-agent: curl/8.0.1]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x55f554a87ea0)
> GET / HTTP/2
> Host: localhost:3000
> user-agent: curl/8.0.1
> accept: */*
> 
< HTTP/2 200 
< content-type: text/plain; charset=utf-8
< content-length: 25
< date: Wed, 12 Apr 2023 10:30:10 GMT
< 
connected to "localhost"

I would assume, it should work the same as with http and http2 (the "Host:"-Line is just inserted by curl -v, but not really on the wire.)

But I am not really an expert. I am just surprised about the different behavior.

[philippgl]

fix proposal incoming...

[ttys3]

per https://httpwg.org/specs/rfc7540.html#HttpRequest

The :authority pseudo-header field includes the authority portion of the target URI ([RFC3986], Section 3.2). The authority MUST NOT include the deprecated userinfo subcomponent for http or https schemed URIs.

To ensure that the HTTP/1.1 request line can be reproduced accurately, this pseudo-header field MUST be omitted when translating from an HTTP/1.1 request that has a request target in origin or asterisk form (see [RFC7230], Section 5.3). Clients that generate HTTP/2 requests directly SHOULD use the :authority pseudo-header field instead of the Host header field. An intermediary that converts an HTTP/2 request to HTTP/1.1 MUST create a Host header field if one is not present in a request by copying the value of the :authority pseudo-header field.

be aware that:

Clients that generate HTTP/2 requests directly SHOULD use the :authority pseudo-header field instead of the Host header field.

also related: grpc/grpc#1025

you should use "host" header field if ":authority" is not present