Skip to content

Conversation

@V-E-O
Copy link

@V-E-O V-E-O commented Dec 15, 2014

if client requests with absolute uri:
GET http://www.github.com HTTP/1.1
Host: www.github.com

tcp-relay will redirect it as:
GET http://http://www.github.com HTTP/1.1
Host: www.github.com

if client requests with absolute uri:
GET http://www.github.com HTTP/1.1
Host: www.github.com

tcp-relay will redirect it as:
GET http://http://www.github.com HTTP/1.1
Host: www.github.com
@V-E-O
Copy link
Author

V-E-O commented Mar 10, 2016

https://tools.ietf.org/html/rfc2616#section-5.1.2

5.1.2 Request-URI

The Request-URI is a Uniform Resource Identifier (section 3.2) and
identifies the resource upon which to apply the request.

   Request-URI    = "*" | absoluteURI | abs_path | authority

@darkk
Copy link
Owner

darkk commented Apr 4, 2016

That's correct, but IMHO http-relay should be avoided as it's can of bugs. Why do you use it?

  • it does not support keep-alive (it modifies only the first request)
  • it is workaround for HTTP/1.0 client that does not send any Host header
  • it is vulnerable to CVE-2009-0801 as original destination IP address is lost, upstream proxy does not know it, and it has to trust Host header that can be manipulated

@darkk darkk force-pushed the master branch 6 times, most recently from 7fa694d to 5df6a30 Compare February 1, 2018 20:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants