Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net/http: incorrectly redirect (301) if request payload include port number #51892

Open
whswork opened this issue Mar 23, 2022 · 6 comments
Open
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone

Comments

@whswork
Copy link

whswork commented Mar 23, 2022

What version of Go are you using (go version)?

$ go version
go version go1.18 linux/arm64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output
$ go env
GO111MODULE=""
GOARCH="arm64"
GOBIN=""
GOCACHE="/home/admin/.cache/go-build"
GOENV="/home/admin/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="arm64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/admin/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/admin/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_arm64"
GOVCS=""
GOVERSION="go1.18"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/admin/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3281198030=/tmp/go-build -gno-record-gcc-switches"

What did you do?

server.go

package main

import (
	"io"
	"log"
	"net/http"
)

func main() {
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		io.WriteString(w, "hello world")
	})

	log.Fatal(http.ListenAndServe(":80", nil))
}

client.go

package main

import (
	"bufio"
	"fmt"
	"io"
	"log"
	"net"
)

func main() {
	// conn, err := net.Dial("tcp", "1.1.1.1:80")
	conn, err := net.Dial("tcp", "127.0.0.1:80")
	if err != nil {
		log.Fatal(err)
	}
	defer conn.Close()

	var payload = "GET localhost:80 HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n"

	_, err = conn.Write([]byte(payload))
	if err != nil {
		log.Fatal(err)
	}

	reader := bufio.NewReader(conn)

	for {
		message, err := reader.ReadString('\n')
		fmt.Print(message)

		if err == io.EOF {
			break
		}
	}
}

What did you expect to see?

HTTP/1.1 400 Bad Request

What did you see instead?

HTTP/1.1 301 Moved Permanently

@mknyszek
Copy link
Contributor

CC @neild

@mknyszek mknyszek added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Mar 23, 2022
@mknyszek
Copy link
Contributor

Is this issue new in 1.18, or does it reproduce with older releases?

@mknyszek mknyszek added this to the Backlog milestone Mar 23, 2022
@whswork
Copy link
Author

whswork commented Mar 23, 2022

exists in go1.17.8 windows/amd64 too

@seankhliao
Copy link
Member

The authority form is only valid for CONNECT, looks like with other methods, net/http just passes the url straight to net/url.ParseRequestURI which parses localhost:80 as scheme: localhost and opaque: 80. Without a parse error, net/http doesn't return a BadRequest.

@neild
Copy link
Contributor

neild commented Mar 23, 2022

Is this actually a problem? And if so, what should the correct behavior be?

The surprise is that you can provide a URL with a non-http scheme as the request-target of GET. Given that, is the current behavior wrong?

@seankhliao
Copy link
Member

The correct behavior is probably to reject the request like we do if the request line doesn't contain a port. RFC 7230 Section 5.3.3 says the authority form is only used for CONNECT.

request line current behavior
CONNECT localhost HTTP/1.1 accepted
CONNECT localhost:80 HTTP/1.1 accepted
GET localhost HTTP/1.1 400 Bad Request
GET localhost:80 HTTP/1.1 301 Moved Permanently

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Development

No branches or pull requests

4 participants