On Tue, Aug 17, 2021 at 06:57:28PM +0200, Tim Düsterhus wrote:
> Hi Willy, Everyone,
> On 8/17/21 5:13 PM, Willy Tarreau wrote:
> > 2) Domain parts in ":scheme" and ":path"
> > 
> > [...] As such HTTP/1 servers are safe and only HTTP/2 servers are exposed.
> I'd like to clarify that the above statement is not true. The issue also
> affects H2->HAProxy->H1 connections. It allows to forward a different 'host'
> header than the one HAProxy sees to the backend.

So to be more precise, based on the output of your test, both will see
the same Host header field, however the server will receive a different
authority than the Host header field. While this is not a valid request
we know that some servers are more willing to accept that than the
poorly formatted requests. However those which do most often only use
the Host (which is why they don't check the authority).

I'm not saying this to try to dismiss the problem, it's in order to
help admins analyze strange logs that they may encounter before
upgrading or deploying workarounds.

> The 'http-request set-uri %[url]' workaround mentioned at the bottom of
> Willy's email also fixes the issue for HTTP/1 backends.
> In any case I recommend to upgrade as soon as possible. That way you don't
> have to think whether your setup requires a workaround or not.

I agree on both points!

Thanks for reporting that one.

Reply via email to