Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net/http: Client and Transport don't support RFC 6874 #9544

Closed
mikioh opened this issue Jan 9, 2015 · 3 comments
Closed

net/http: Client and Transport don't support RFC 6874 #9544

mikioh opened this issue Jan 9, 2015 · 3 comments
Milestone

Comments

@mikioh
Copy link
Contributor

mikioh commented Jan 9, 2015

On all released versions, Get with a literal IPv6 address with a zone identifier fails. For example,

u := &url.URL{Scheme: "http", Host: "[::1%lo0]:8080"}
resp, err := http.DefaultClient.Get(u.String())

and

resp, err := http.Get("http://[::1%lo0]:8080")

return parse http://[::1%lo0]:8080: hexadecimal escape in host or parse [::1%lo0]:8080: invalid URL escape "%lo" error. After the fix of #6530, the former works well but the latter still fails.

@mikioh
Copy link
Contributor Author

mikioh commented Jan 9, 2015

In the latter case with the fix of #6530, the Host line of request headers is wrong.

Host: [::1%en0]:8080

On the wire, the line must be

Host: [::1%25en0]:8080

@mikioh
Copy link
Contributor Author

mikioh commented Jan 9, 2015

A correction. As per RFC 6874, the line must be

Host: [::1]:8080

The RFC says that an HTTP client, proxy, or other intermediary MUST remove any ZoneID attached to an outgoing URI, as it has only local significance at the sending host.

@mikioh mikioh closed this as completed Jan 9, 2015
@mikioh mikioh reopened this Jan 9, 2015
@mikioh mikioh closed this as completed in 957255f Apr 9, 2015
@mikioh mikioh added this to the Go1.5 milestone Apr 9, 2015
@gopherbot
Copy link

CL https://golang.org/cl/13296 mentions this issue.

gopherbot pushed a commit to golang/net that referenced this issue Aug 13, 2015
…FC 6874

When making a request to an IPv6 address with a zone identifier, for
exmaple [fe80::1%en0], RFC 6874 says HTTP clients must remove the zone
identifier "%en0" before writing the request for security reason.

This change removes any IPv6 zone identifer attached to URI in the Host
header field in requests.

See golang/go#9544.

Change-Id: Ie5d18a0bc5f2768a95c59ec2b159ac0abdf685e8
Reviewed-on: https://go-review.googlesource.com/13296
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
@golang golang locked and limited conversation to collaborators Aug 5, 2016
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants