search

mashupbots / socko

A Scala web server powered by Netty networking and AKKA processing.
Other
255 stars 51 forks source link

When establishing a WebSocket, handle empty `Host` header #102

Open tkellogg opened 9 years ago

tkellogg commented 9 years ago

I found this because our production environment is logging a lot of these exceptions. It appears that some clients are sending malformed requests to initiate a WebSocket session. Socko seems to report this as 500 and logs an exception, however it should report 400.

Specifically, the problem is on this line: https://github.com/mashupbots/socko/blob/master/socko-webserver/src/main/scala/org/mashupbots/socko/events/HttpRequestMessage.scala#L129

From glancing through Netty source code, it looks like getHost will return null when the Host header is absent. I was going to send a pull request for this issue but I'm not familiar enough with Socko to know the proper place to check for & report the error.

malibuworkcrew commented 9 years ago

Incidentally this can cause any HTTP/1.0 call without a host on its header to hang indefinitely. Making socko very vulnerable to DDoS.