csmith / centauri

TLS-terminating reverse proxy in Go
MIT License
1 stars 1 forks source link

http/2 connection reuse behaviour causes wrong sites to be displayed #89

Closed ShaneMcC closed 2 months ago

ShaneMcC commented 2 months ago

If I have 2 domains a.example.org and b.example.org sharing a wildcard certificate for *.example.org, then sometimes visiting one of them will actually proxy to the other one.

eg:

In chrome if I open a new incognito window and visit a.example.org then b.example.org I will see the content for a in both tabs.

If I close all the incognito windows, and try again and open a new incognito window and visit b.example.org then a.example.org I will see the content for b in both tabs.

This looks to be related to HTTP/2 connection reuse

Connections that are made to an origin server, either directly or through a tunnel created using the CONNECT method (Section 8.3), MAY be reused for requests with multiple different URI authority components. A connection can be reused as long as the origin server is authoritative (Section 10.1). For TCP connections without TLS, this depends on the host having resolved to the same IP address.

ShaneMcC commented 2 months ago

For further background-reading, this is often known as Connection Coalescing

csmith commented 2 months ago

Thanks for the report and amazing debugging :D. Fixed in v0.5.3