Handling HTTP/2 connection coalescing issues originating from wildcard certificates#50603
Handling HTTP/2 connection coalescing issues originating from wildcard certificates#50603ahus1 wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
This pull request adds a Quarkus runtime request filter to reject “misdirected” requests (HTTP 421) when the incoming Host/:authority does not match the configured Keycloak hostname(s), mitigating HTTP/2 connection coalescing problems with wildcard certificates (as described in #50602).
Changes:
- Introduces
RejectMisdirectedRequestFilterand wires it into the Quarkus filter chain, with runtime configuration based on hostname settings. - Adds a new (deprecated) config option
hostname-strict-host-check(defaulttrue) to allow disabling the behavior for compatibility. - Extends distribution/integration tests and host mappings to cover accepted/rejected host scenarios, including admin hostname allowance.
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| quarkus/tests/integration/src/test/resources/hosts_file | Adds admin.mykeycloak.org to local host resolution for new hostname tests. |
| quarkus/tests/integration/src/test/java/org/keycloak/it/cli/dist/ProxyHostnameV2DistTest.java | Adds coverage for 421 behavior and updates an existing test to disable strict host checking for compatibility. |
| quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/resources/ConstantsDebugHostname.java | Exposes the new option on the hostname debug page. |
| quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/services/RejectMisdirectedRequestFilter.java | New Vert.x filter implementing the 421 rejection logic. |
| quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/KeycloakRecorder.java | Creates/configures the filter at runtime init based on hostname and management settings. |
| quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/HostnameV2PropertyMappers.java | Registers the new hostname option with the configuration mapping layer. |
| quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/MisdirectedRequestFilterBuildItem.java | New build item to carry the filter instance from static init to runtime init configuration. |
| quarkus/deployment/src/main/java/org/keycloak/quarkus/deployment/KeycloakProcessor.java | Wires the filter into the global filter chain and adds a runtime-init build step to configure it. |
| quarkus/config-api/src/main/java/org/keycloak/config/HostnameV2Options.java | Adds the hostname-strict-host-check option (deprecated, default true). |
…d certificates Closes keycloak#50602 Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
241b791 to
499beb2
Compare
|
We moved forward with #50607. There is an allowed-hosts feature in later versions of quarkus that has a great deal of overlap with what was proposed in this pr. A issue of whether there should be any bridge between allowed-hosts and the misdirected detection is at quarkusio/quarkus#55586 |
|
@shawkins - sorry for the delayed feedback. It seems to me that your PR is not addressing the coalescing issue. Let me re-open the parent issue to continue the discussion there. |
I believe there is a misunderstanding in what that PR is doing. In the meantime, I think we can close this PR in favor of what quarkus added with quarkusio/quarkus#55431 |
Closes #50602