Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When establishing a WebSocket, handle empty Host header #102

Open
tkellogg opened this issue Nov 7, 2014 · 1 comment · May be fixed by #105
Open

When establishing a WebSocket, handle empty Host header #102

tkellogg opened this issue Nov 7, 2014 · 1 comment · May be fixed by #105

Comments

@tkellogg
Copy link

tkellogg commented Nov 7, 2014

I found this because our production environment is logging a lot of these exceptions. It appears that some clients are sending malformed requests to initiate a WebSocket session. Socko seems to report this as 500 and logs an exception, however it should report 400.

Specifically, the problem is on this line: https://github.com/mashupbots/socko/blob/master/socko-webserver/src/main/scala/org/mashupbots/socko/events/HttpRequestMessage.scala#L129

From glancing through Netty source code, it looks like getHost will return null when the Host header is absent. I was going to send a pull request for this issue but I'm not familiar enough with Socko to know the proper place to check for & report the error.

tkellogg pushed a commit to tkellogg/socko that referenced this issue Dec 11, 2014
@tkellogg tkellogg linked a pull request Dec 11, 2014 that will close this issue
@malibuworkcrew
Copy link

Incidentally this can cause any HTTP/1.0 call without a host on its header to hang indefinitely. Making socko very vulnerable to DDoS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants