jwebserver should reject requests for absolute URLs

XMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: P4
    • None
    • Affects Version/s: 18
    • Component/s: core-libs
    • None

      currently jwebserver just ignores the host / authority part of the request.
      Absolute URLs are used in proxy requests. Jwebserver is not a proxy, and should reject these requests.

      Steps to reproduce:
      - start jwebserver (by default it starts on 127.0.0.1:8000)
      - send a request to a different server using 127.0.0.1 as a proxy

      example:
      curl -v -x http://127.0.0.1:8000 http://example.com

      internally sends:
      > GET http://example.com/ HTTP/1.1
      > Host: example.com

      expected response:
      some sort of error; Google uses 404 Not found

      actual response:
      Success: server returns the directory listing

            Assignee:
            Jaikiran Pai
            Reporter:
            Daniel Jelinski
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: