Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Can Tomcat accept HTTP 1.1 requests without a Host header?

HTTP 1.1 states: "A client MUST include a Host header field in all HTTP/1.1 request messages"

However, the machines I am working on send out this exact POST (containing coordinates), which I do not have access to change:

POST /touch HTTP/1.1
Content-type: application/x-www-form-urlencoded
Content-Length: <n>

x=<int x>&y=<int y>

Tomcat 7 immediately responds with 400 Bad Request due to the lack of a Host header field, and the POST never gets to my servlet. Is there any way I can avoid this error response and handle the POST with the servlet to support these older machines?

like image 928
user1684196 Avatar asked Oct 09 '12 21:10

user1684196


People also ask

Is HTTP host header mandatory?

The HTTP host header is a request header that specifies the domain that a client (browser) wants to access. This header is necessary because it is pretty standard for servers to host websites and applications at the same IP address. However, they don't automatically know where to direct the request.

Do all browsers send host header?

Yes, all mainstream browsers send the Host header as it is mandatory for all requests sent via HTTP/1.1.

What is host header in request?

The Host request header specifies the host and port number of the server to which the request is being sent. If no port is included, the default port for the service requested is implied (e.g., 443 for an HTTPS URL, and 80 for an HTTP URL). A Host header field must be sent in all HTTP/1.1 request messages.

How many concurrent connections can Tomcat handle?

The default installation of Tomcat sets the maximum number of HTTP servicing threads at 200. Effectively, this means that the system can handle a maximum of 200 simultaneous HTTP requests.


1 Answers

As you already noted, HTTP 1.1 spec says (bold mine):

A client MUST include a Host header field in all HTTP/1.1 request messages. [...] An HTTP/1.1 proxy MUST ensure that any request message it forwards does contain an appropriate Host header field that identifies the service being requested by the proxy. All Internet-based HTTP/1.1 servers MUST respond with a 400 (Bad Request) status code to any HTTP/1.1 request message which lacks a Host header field.

The client is using HTTP 1.1 protocol incorrectly, you should not try to work around that on the server side. What you can do is setup some custom HTTP proxy that will just add the Host header. But that's a dirty workaround. Alternatively downgrade the protocol to 1.0.

Also note that even if you somehow manage to make Tomcat accept such requests (which is against the specification), you'll still run into some issues if any HTTP proxy is between ends.

like image 173
Tomasz Nurkiewicz Avatar answered Sep 29 '22 18:09

Tomasz Nurkiewicz