#27379: Django violates RFC7230 when handling requests.
--------------------------------------+--------------------
Reporter: Stavros Korokithakis | Owner: nobody
Type: Bug | Status: new
Component: Uncategorized | Version: 1.10
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+--------------------
For a request coming in with an absolute URI and a different host header,
Django still uses the Host header value to service the request. RFC 7230
specifies:
If the request-target is in absolute-form, the effective request URI
is the same as the request-target.
(https://tools.ietf.org/html/rfc7230#section-5.5)
Thus, if a request comes in where the host header is different from the
host in the absolute URI, Django should use the absolute URI, rather than
the host value.
This is a problem when a request comes in looking like:
GET https://valid.hostname/ HTTP/1.1
Host: invalid.hostname
Django currently fails this as a violation of ALLOWED_HOSTS, but it
shouldn't. Granted, we only see this in attacks, but nginx passes these
requests through (because it should) and Django fails them because of the
wonky host.
--
Ticket URL: <https://code.djangoproject.com/ticket/27379>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/056.6dce10c88bed47809be9cfa8bdd5bccb%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
