GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — http.server: HTTP/1.1 requests without Host, with two Host fields or with an invalid Host value are accepted · Issue #161675 · python/cpython

http.server: HTTP/1.1 requests without Host, with two Host fields or with an invalid Host value are accepted #161675

New issue
Copy link
New issue
Copy link
Open
Open
http.server: HTTP/1.1 requests without Host, with two Host fields or with an invalid Host value are accepted#161675
Copy link
Labels
stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

Description

@Confusion
Confusion
opened on Nov 9, 2026
Issue body actions

Bug report

BaseHTTPRequestHandler.parse_request does not look at the Host field. RFC 9112 section 3.2 states: "A server MUST respond with a 400 (Bad Request) status code to any HTTP/1.1 request message that lacks a Host header field and to any request message that contains more than one Host header field line or a Host header field with an invalid field value."

All three kinds of request below get status 200 and reach the handler. The 400 for a missing Host is from RFC 2616 section 14.23; the 400 for duplicate or invalid Host values was added in RFC 7230 section 5.4 (2014).

import http.server, socket, threading

class Handler(http.server.BaseHTTPRequestHandler):
    protocol_version = "HTTP/1.1"
    def do_GET(self):
        body = ("Host: %r\n" % self.headers.get_all("Host")).encode()
        self.send_response(200)
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)
    def log_message(self, *args): pass

server = http.server.ThreadingHTTPServer(("127.0.0.1", 0), Handler)
threading.Thread(target=server.serve_forever, daemon=True).start()

for request in [b"GET / HTTP/1.1\r\n\r\n",
                b"GET / HTTP/1.1\r\nHost: a.example\r\nHost: b.example\r\n\r\n",
                b"GET / HTTP/1.1\r\nHost: a b\r\n\r\n"]:
    with socket.create_connection(server.server_address, timeout=2) as s:
        s.sendall(request)
        s.shutdown(socket.SHUT_WR)
        lines = s.makefile("rb").read().split(b"\r\n")
    print(request, "->", lines[0], lines[-1])
server.shutdown()

Output:

b'GET / HTTP/1.1\r\n\r\n' -> b'HTTP/1.1 200 OK' b'Host: None\n'
b'GET / HTTP/1.1\r\nHost: a.example\r\nHost: b.example\r\n\r\n' -> b'HTTP/1.1 200 OK' b"Host: ['a.example', 'b.example']\n"
b'GET / HTTP/1.1\r\nHost: a b\r\n\r\n' -> b'HTTP/1.1 200 OK' b"Host: ['a b']\n"

Expected: HTTP/1.1 400 Bad Request for all three requests.

CPython versions tested on:

3.14

Operating systems tested on:

Linux

Linked PRs

  • gh-161675: Reject missing and duplicate Host headers in http.server #161696

Activity

  1. Confusion
    added
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Nov 9, 2026
  2. aisk
    added
    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory
    on Nov 9, 2026
  3. aisk
    added this to HTTP issueson Nov 9, 2026
  4. github-project-automation
    moved this to Todo in HTTP issueson Nov 9, 2026
  5. vishy0
    added 2 commits that reference this issue on Nov 9, 2026

    pythongh-161675: Reject missing and duplicate Host headers in http.se…

    73c8abf

    pythongh-161675: Reject missing and duplicate Host headers in http.se…

    24ed59c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

    Projects

    • HTTP issues
      Status
      Todo
      Show more project fields

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.