[7.0] Allow overriding the host header if doesn't match the absolute-form host #48415
Conversation
…ost (dotnet#39334) * Allow overriding the host header if doesn't match the absolute-form host * Apply suggestions from code review Co-authored-by: Stephen Halter <halter73@gmail.com>
amcasey
requested review from
Tratcher,
halter73,
BrennanConroy and
JamesNK
as code owners
ghost
added
the
|
Hi @amcasey. If this is not a tell-mode PR, please make sure to follow the instructions laid out in the servicing process document. |
|
I'll make a separate PR (and API issue) for the corresponding change in 8.0. |
|
@Tratcher I don't think there are packaging changes (I assume that means shipping different files rather than different file contents). What's the required manual validation? Make a client send a mangled request? |
|
Yes, just test it locally with one of the sample apps and a raw socket client. |
adityamandaleeka
changed the title
BrennanConroy
added
the
Servicing-consider
|
Hi @amcasey. Please make sure you've updated the PR description to use the Shiproom Template. Also, make sure this PR is not marked as a draft and is ready-to-merge. To learn more about how to prepare a servicing PR click here. |
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
adityamandaleeka
added
Servicing-approved
|
Hi @amcasey. This PR was just approved to be included in the upcoming servicing release. Somebody from the @dotnet/aspnet-build team will get it merged when the branches are open. Until then, please make sure all the CI checks pass and the PR is reviewed. |
|
Approved over email. |
|
Internal partner dropped their request. |
amcasey
added
area-networking
Allow overriding the host header if doesn't match the absolute-form host
Description
Allow overriding the host header if doesn't match the absolute-form host.
This is a cherry-pick of #39334 (plus an explanatory comment).
The same partner that requested this for 6.0 needs it in 7.0 (see #39335).
Customer Impact
Some clients send malformed host headers and the server wants to use the value from the request target instead, as in IIS/httpsys.
Regression?
Kind of - it was added to 6.0 in servicing and deliberately not ported to 7.0 until there was a request.
Risk
The merge was very easy - just some whitespace changes - and the functionality is opt-in.
Verification
Packaging changes reviewed?