Skip to content

httputil: Process the Host header more strictly#3487

Merged
bdarnell merged 1 commit intotornadoweb:masterfrom
bdarnell:strict-host
Apr 25, 2025
Merged

httputil: Process the Host header more strictly#3487
bdarnell merged 1 commit intotornadoweb:masterfrom
bdarnell:strict-host

Conversation

@bdarnell
Copy link
Member

  • It is now an error to have multiple Host headers
  • The Host header is now mandatory except in HTTP/1.0 mode
  • Host headers containing characters that are disallowed by RFC 3986 are now rejected

Fixes #3468

- It is now an error to have multiple Host headers
- The Host header is now mandatory except in HTTP/1.0 mode
- Host headers containing characters that are disallowed by RFC 3986
  are now rejected

Fixes tornadoweb#3468
@bdarnell bdarnell merged commit 1a8c152 into tornadoweb:master Apr 25, 2025
15 checks passed
@bdarnell bdarnell deleted the strict-host branch April 25, 2025 19:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Issues in Parsing HTTP Request "Host" Header

1 participant