search

hyperium / hyper

An HTTP library for Rust
https://hyper.rs
MIT License
14.08k stars 1.55k forks source link

fix: Do not include user information in Host header #3621

Open tindzk opened 2 months ago

tindzk commented 2 months ago

According to RFC 9110, section 7.2, the Host header should only comprise the URI host and an optional port.

Currently, the examples set the Host header to the URI's authority which may also contain user information (see RFC 3986, section 3.2).

Update the examples to construct the Host header manually to avoid sensitive information from showing up in server logs and to ensure that the server's routing logic works correctly when a username and password are supplied.

seanmonstar commented 2 months ago

Thanks for the PR! I agree with your assessment, this is more correct. I do wish, however, that the examples could remain as simple as possible...

hyper-util's legacy Client does it automatically. That should get extracted to a helper middleware, like SetHost. We can't reference it now, but if we eventually could, would a comment like // consider using tower_http::SetHost help people? This isn't very actionable in this PR...

tindzk commented 2 months ago

I agree with the sentiment of keeping the examples as minimal as possible. I have shortened the fix to always include the port number. This should be compatible with the majority of servers out there.

The same issue is also present on the website: https://hyper.rs/guides/1/client/basic/

sfackler commented 2 months ago

@seanmonstar I think this was closed by accident?