Fix cross-host routing on keep-alive plain proxy connections - #719
Merged
Merged
Conversation
Http11DownStreamPipe stamped every request after the first with the connection level authority, so a request for host B could go out over a connection to host A (wrong body from permissive origins, 421 from strict ones). Plain forward and reverse proxy pipes now resolve the authority from each request, tunneled connections keep the fixed one.
Owner
Author
This was referenced Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the cross-host contamination reported on 1.39.6-alpha: a feed fetch could receive and persist the body of an unrelated site, and strict origins rejected misdirected requests with 421.
On a keep-alive plain HTTP proxy connection, Http11DownStreamPipe stamped every request after the first with the connection level authority, parsed from the first request only. A request for host B was then routed through host A's connection pool while carrying Host: B. Permissive origins answer that with their default vhost content, strict ones with 421 Misdirected Request.
The plain forward and reverse proxy providers now enable per-request authority resolution on the pipe, using the same absolute-form URI or Host fallback logic as the first request, factored into AuthorityUtility.TryParsePlainRequestAuthority. Tunneled connections (CONNECT, SOCKS5) keep the connection level authority since their destination is fixed by the tunnel.
Includes a regression test driving three absolute-form requests alternating between two local origins over a single keep-alive client connection; it fails on the previous code.