#27379: Django violates RFC7230 when handling requests.
-------------------------------------+-------------------------------------
Reporter: Stavros | Owner: nobody
Korokithakis |
Type: Bug | Status: new
Component: Uncategorized | Version: 1.10
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by Stavros Korokithakis):
* needs_better_patch: => 0
* needs_tests: => 0
* needs_docs: => 0
Old description:
> For a request coming in with an absolute URI and a different host header,
> Django still uses the Host header value to service the request. RFC 7230
> specifies:
>
> If the request-target is in absolute-form, the effective request URI
> is the same as the request-target.
>
> (https://tools.ietf.org/html/rfc7230#section-5.5)
>
> Thus, if a request comes in where the host header is different from the
> host in the absolute URI, Django should use the absolute URI, rather than
> the host value.
>
> This is a problem when a request comes in looking like:
>
> GET https://valid.hostname/ HTTP/1.1
> Host: invalid.hostname
>
> Django currently fails this as a violation of ALLOWED_HOSTS, but it
> shouldn't. Granted, we only see this in attacks, but nginx passes these
> requests through (because it should) and Django fails them because of the
> wonky host.
New description:
For a request coming in with an absolute URI and a different host header,
Django still uses the Host header value to service the request. RFC 7230
specifies:
If the request-target is in absolute-form, the effective request URI
is the same as the request-target.
(https://tools.ietf.org/html/rfc7230#section-5.5)
Thus, if a request comes in where the host header is different from the
host in the absolute URI, Django should use the absolute URI, rather than
the host value.
This is a problem when a request comes in looking like:
{{{
GET https://valid.hostname/ HTTP/1.1
Host: invalid.hostname
}}}
Django currently fails this as a violation of ALLOWED_HOSTS, but it
shouldn't. Granted, we only see this in attacks, but nginx passes these
requests through (because it should) and Django fails them because of the
wonky host.
--
--
Ticket URL: <https://code.djangoproject.com/ticket/27379#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/071.5d484209c79481328659e1883c14f4ca%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
