"400 Bad Request The HTTP request did not have a Host header", but I added it manually #1895

GTP95 · 2023-07-04T14:41:31Z

GTP95
Jul 4, 2023

Greetings,

I'm building a client inside a class specifying the connection_verbose option:

let client_builder=reqwest::Client::builder()
            .connection_verbose(true); //print verbose connection info for debugging
let client= client_builder.build().expect("Error building HTTPS client");

Then I'm making the following request:

let request = self.client
            .get(auth_endpoint_url_with_params)
            .header("Host", host_with_port)   //let's be compliant to the HTTP specs
            .header("Shib-Spoof-Check", spoof_check_secret)
            .header(self.uid_field_name.clone(), uid)
            .body("")
            .send()
            .await?;

But I'm getting the following error as output:

2023-07-04T14:24:44.800Z DEBUG [reqwest::connect] starting new connection: http://localhost:8080/
2023-07-04T14:24:44.801Z TRACE [reqwest::connect::verbose] b25362fb write (vectored): b"GET /auth?&user=participant:bdd25f2c-abb9-40be-ac89-5e538dad1e70&client_id=123&redirect_uri=%22http://127.0.0.1%22,%22http://localhost:16515%22&response_type=code&code_challenge=26ab0547599e8658448104163e13698dbc16769a656573a8d8db5cc2e3eadf6d&code_challenge_method=S256 HTTP/1.1\r\nshib-spoof-check: be67c8dd6a141ded148861ac11aef64d68640876601a40dca01816004e4c5161\r\nuid: participant:bdd25f2c-abb9-40be-ac89-5e538dad1e70\r\naccept: */*\r\nhost: localhost:8080\r\n\r\n"
2023-07-04T14:24:44.802Z TRACE [reqwest::connect::verbose] b25362fb read: b"HTTP/1.1 400 Bad Request\r\nContent-Length: 44\r\n\r\nThe HTTP request did not have a Host header."
2023-07-04T14:24:44.802Z TRACE [reqwest::connect::verbose] b25362fb read: b""
Response: Response { url: Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: Some(8080), path: "/auth", query: Some("&user=participant:bdd25f2c-abb9-40be-ac89-5e538dad1e70&client_id=123&redirect_uri=%22http://127.0.0.1%22,%22http://localhost:16515%22&response_type=code&code_challenge=26ab0547599e8658448104163e13698dbc16769a656573a8d8db5cc2e3eadf6d&code_challenge_method=S256"), fragment: None }, status: 400, headers: {"content-length": "44"} }

I get the error about the missing header regardless of whether I add .header("Host", host_with_port) or not.
But if I try to make the same request with curl, I get a 200 instead:

$ curl -v "http://localhost:8080/auth&user=participant:bdd25f2c-abb9-40be-ac89-5e538dad1e70&client_id=123&redirect_uri=%22http://127.0.0.1%22,%22http://localhost:16515%22&response_type=code&code_challenge=00dec083e805d3b90a3e0cf468a7c4540805209c689d7031af7cea24376afd50&code_challenge_method=S256" -H "uid: participant:bdd25f2c-abb9-40be-ac89-5e538dad1e70" -H "Shib-Spoof-Check: be67c8dd6a141ded148861ac11aef64d68640876601a40dca01816004e4c5161" 
*   Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET /auth&user=participant:bdd25f2c-abb9-40be-ac89-5e538dad1e70&client_id=123&redirect_uri=%22http://127.0.0.1%22,%22http://localhost:16515%22&response_type=code&code_challenge=00dec083e805d3b90a3e0cf468a7c4540805209c689d7031af7cea24376afd50&code_challenge_method=S256 HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/8.1.2
> Accept: */*
> uid: participant:bdd25f2c-abb9-40be-ac89-5e538dad1e70
> Shib-Spoof-Check: be67c8dd6a141ded148861ac11aef64d68640876601a40dca01816004e4c5161
> 
< HTTP/1.1 200 OK
< Content-Length: 1994
< 
<html><body><a href="/auth&user=participant:bdd25f2c-abb9-40be-ac89-5e538dad1e70&client_id=123&redirect_uri="http:/127.0.0.1","http:/localhost:16515"&response_type=code&code_challenge=00dec083e805d3b90a3e0cf468a7c4540805209c689d7031af7cea24376afd50&code_challenge_method=S256?user=assessor%40master.pep.cs.ru.nl">Research Assessor</a><br><a href="/auth&user=participant:bdd25f2c-abb9-40be-ac89-5e538dad1e70&client_id=123&redirect_uri="http:/127.0.0.1","http:/localhost:16515"&response_type=code&code_challenge=00dec083e805d3b90a3e0cf468a7c4540805209c689d7031af7cea24376afd50&code_challenge_method=S256?user=monitor%40master.pep.cs.ru.nl">Monitor</a><br><a href="/auth&user=participant:bdd25f2c-abb9-40be-ac89-5e538dad1e70&client_id=123&redirect_uri="http:/127.0.0.1","http:/localhost:16515"&response_type=code&code_challenge=00dec083e805d3b90a3e0cf468a7c4540805209c689d7031af7cea24376afd50&code_challenge_method=S256?user=dataadmin%40master.pep.cs.ru.nl">Data Administrator</a><br><a href="/auth&user=participant:bdd25f2c-ab* Connection #0 to host localhost left intact

In the curl request, I didn't specify the Host header, so I guess curl is adding that automatically. But then I wonder why with reqwest it fails regardless of whether I specify it or not. What am I getting wrong?
Thank you for your help,

GTP95

Answered by seanmonstar

Jul 4, 2023

reqwest add the host header automatically, too. You can see it in the verbose output.

It could be that the server (wrongly) depends on a specific capitalization of the name. If so, you can enable ClientBuilder::http1_title_case_headers() option.

View full answer

seanmonstar · 2023-07-04T16:02:22Z

seanmonstar
Jul 4, 2023
Maintainer

reqwest add the host header automatically, too. You can see it in the verbose output.

It could be that the server (wrongly) depends on a specific capitalization of the name. If so, you can enable ClientBuilder::http1_title_case_headers() option.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

"400 Bad Request The HTTP request did not have a Host header", but I added it manually #1895

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

"400 Bad Request The HTTP request did not have a Host header", but I added it manually #1895

Uh oh!

GTP95 Jul 4, 2023

Replies: 1 comment

Uh oh!

seanmonstar Jul 4, 2023 Maintainer

GTP95
Jul 4, 2023

seanmonstar
Jul 4, 2023
Maintainer