Skip to content

Conversation

@gsoldevila
Copy link

@gsoldevila gsoldevila commented Nov 6, 2025

Summary

Fixes #4560

Problem

In HTTP2 the Host: header is no longer present. According to the spec:

In HTTP/2, the functionality of the HTTP/1.1 Host header is replaced by the :authority pseudo-header, which is a mandatory, colon-prefixed header that specifies the authority (host and port) of the target server. This change is part of HTTP/2's binary framing and header compression (HPACK), and any HTTP/2 request converted to HTTP/1.1 must create a Host header from the :authority pseudo-header.

  • When building the request object and extracting its information (here), we rely solely on Host: header.
  • Then, when starting Hapi in HTTP2 mode and performing a request, the Host: header is missing, so the request.url getter) uses the host:port from the _core.info.
  • Now, if the server is configured with an IPv6 host (such as ::1), the getter ends up building an invalid URL, as the host name is not surrounded by square brackets. An IPv6 address like 2001:db8::1:8080 would be ambiguous, as 8080 could be interpreted as the last segment of the IP address rather than the port.

Solution

The PR updates the request logic in 2 places:

  • First, we default to using :authority if Host header is NOT present.
  • Then, if for any reason both headers are missing and we default to using the server info, we make the logic support the IPv6 scenario by wrapping the hostname (e.g. ::1) in square brackets [::1].

@gsoldevila gsoldevila marked this pull request as draft November 6, 2025 15:23
@gsoldevila gsoldevila force-pushed the fix/4556-protect-invalid-ipv6-in-request-url branch from 3eb41e7 to 4f47a71 Compare November 7, 2025 10:08
@gsoldevila gsoldevila marked this pull request as ready for review November 7, 2025 10:50
@gsoldevila gsoldevila changed the title fix: 🐛 request.url getter fails when using bare IPv6 hosts [#4556] fix: 🐛 request.url getter fails when using bare IPv6 hosts [#4560] Nov 7, 2025
@gsoldevila gsoldevila changed the title fix: 🐛 request.url getter fails when using bare IPv6 hosts [#4560] fix: 🐛 request.url getter fails when using IPv6 and HTTP2 [#4560] Nov 7, 2025

const req = request.raw.req;
const host = req.headers.host ? req.headers.host.trim() : '';
const host = (req.headers.host || req.headers[':authority'] || '').trim();
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps we could test if the req is an IPv6 request somehow, and choose Host or :authority accordingly. WDYT?

gsoldevila added a commit to elastic/kibana that referenced this pull request Nov 11, 2025
…#242241)

## Summary

Workarounds #236380

The official way to address this is with the following issue + PR on
hapijs/hapi side:
* hapijs/hapi#4560
* hapijs/hapi#4559

Until then, we can inject the Host information that Hapi relies on when
it builds the `url` string.
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Nov 11, 2025
…elastic#242241)

## Summary

Workarounds elastic#236380

The official way to address this is with the following issue + PR on
hapijs/hapi side:
* hapijs/hapi#4560
* hapijs/hapi#4559

Until then, we can inject the Host information that Hapi relies on when
it builds the `url` string.

(cherry picked from commit 0d41ec2)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Nov 11, 2025
…elastic#242241)

## Summary

Workarounds elastic#236380

The official way to address this is with the following issue + PR on
hapijs/hapi side:
* hapijs/hapi#4560
* hapijs/hapi#4559

Until then, we can inject the Host information that Hapi relies on when
it builds the `url` string.

(cherry picked from commit 0d41ec2)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Nov 11, 2025
…elastic#242241)

## Summary

Workarounds elastic#236380

The official way to address this is with the following issue + PR on
hapijs/hapi side:
* hapijs/hapi#4560
* hapijs/hapi#4559

Until then, we can inject the Host information that Hapi relies on when
it builds the `url` string.

(cherry picked from commit 0d41ec2)
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Nov 11, 2025
…elastic#242241)

## Summary

Workarounds elastic#236380

The official way to address this is with the following issue + PR on
hapijs/hapi side:
* hapijs/hapi#4560
* hapijs/hapi#4559

Until then, we can inject the Host information that Hapi relies on when
it builds the `url` string.

(cherry picked from commit 0d41ec2)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Hapi request fails when using HTTP2 and IPv6

1 participant