Repository navigation
Remove the port from the Host header before checking the certificate name - #59
Merged
Merged
Conversation
…name When a request has a Host header, the Asio and WinHTTP clients check the server certificate against that value instead of the URI host. A Host header may include a port, for example "example.com:8443", and the check then failed because no certificate name includes the port. Remove the port, keeping the brackets around an IPv6 address as uri::host() does. The request still sends the Host header unchanged. Fixes microsoft#1790 and microsoft#1471. Signed-off-by: Gareth Sylvester-Bradley <garethsb@nvidia.com>
32 of 34 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a request has a
Hostheader, the Asio and WinHTTP clients check the server certificate against that value instead of the URI host. AHostheader may include a port, for exampleexample.com:8443. No certificate name includes the port, so the check fails: the TLS handshake fails with the Asio client, and the request fails with "Incorrect common name" with WinHTTP.This PR adds
web::http::details::host_without_porttointernal_http_helpers.hand uses it in both clients' certificate name checks. It keeps the brackets around an IPv6 address, asuri::host()does. The request still sends theHostheader unchanged. In the Asio client, the stripped name is also the TLS server name and the connection pool key, so the port no longer appears in either of those.As agreed, the new test
host_without_portcovers only the host parsing. A test of the certificate check itself would need a TLS server.On Ubuntu 26.04 with Clang 21 in Debug, the HTTP client, HTTP listener and WebSocket client suites pass. On Windows with Visual Studio 2026 in Debug, all 192 WinHTTP client tests pass.
Fixes microsoft#1790 and microsoft#1471.
Co-authored-by: Gareth's 🤖 buddy