[bugfix] Set the Host header within the signing transport (#2799)

superseriousbusiness · Apr 2, 2024 · e664d09 · e664d09
1 parent d61d5c8
commit e664d09
Show file tree

Hide file tree

Showing 7 changed files with 3 additions and 9 deletions.
diff --git a/internal/httpclient/sign.go b/internal/httpclient/sign.go
@@ -37,6 +37,9 @@ type signingtransport struct {
 }
 
 func (t *signingtransport) RoundTrip(r *http.Request) (*http.Response, error) {
+	// Ensure updated host always set.
+	r.Header.Set("Host", r.URL.Host)
+
 	if sign := gtscontext.HTTPClientSignFunc(r.Context()); sign != nil {
 		// Reset signing header fields
 		now := time.Now().UTC()

diff --git a/internal/processing/admin/debug_apurl.go b/internal/processing/admin/debug_apurl.go
@@ -97,7 +97,6 @@ func (p *Processor) DebugAPUrl(
 
 	req.Header.Add("Accept", string(apiutil.AppActivityLDJSON)+","+string(apiutil.AppActivityJSON))
 	req.Header.Add("Accept-Charset", "utf-8")
-	req.Header.Set("Host", url.Host)
 
 	// Perform the HTTP request,
 	// and return everything.

diff --git a/internal/transport/deliver.go b/internal/transport/deliver.go
@@ -120,7 +120,6 @@ func (t *transport) deliver(ctx context.Context, b []byte, to *url.URL) error {
 
 	req.Header.Add("Content-Type", string(apiutil.AppActivityLDJSON))
 	req.Header.Add("Accept-Charset", "utf-8")
-	req.Header.Set("Host", to.Host)
 
 	rsp, err := t.POST(req, b)
 	if err != nil {

diff --git a/internal/transport/dereference.go b/internal/transport/dereference.go
@@ -54,7 +54,6 @@ func (t *transport) Dereference(ctx context.Context, iri *url.URL) (*http.Respon
 
 	req.Header.Add("Accept", string(apiutil.AppActivityLDJSON)+","+string(apiutil.AppActivityJSON))
 	req.Header.Add("Accept-Charset", "utf-8")
-	req.Header.Set("Host", iri.Host)
 
 	// Perform the HTTP request
 	rsp, err := t.GET(req)

diff --git a/internal/transport/derefinstance.go b/internal/transport/derefinstance.go
@@ -93,7 +93,6 @@ func dereferenceByAPIV1Instance(ctx context.Context, t *transport, iri *url.URL)
 	}
 
 	req.Header.Add("Accept", string(apiutil.AppJSON))
-	req.Header.Set("Host", cleanIRI.Host)
 
 	resp, err := t.GET(req)
 	if err != nil {
@@ -250,7 +249,6 @@ func callNodeInfoWellKnown(ctx context.Context, t *transport, iri *url.URL) (*ur
 		return nil, err
 	}
 	req.Header.Add("Accept", string(apiutil.AppJSON))
-	req.Header.Set("Host", cleanIRI.Host)
 
 	resp, err := t.GET(req)
 	if err != nil {
@@ -308,7 +306,6 @@ func callNodeInfo(ctx context.Context, t *transport, iri *url.URL) (*apimodel.No
 		return nil, err
 	}
 	req.Header.Add("Accept", string(apiutil.AppJSON))
-	req.Header.Set("Host", iri.Host)
 
 	resp, err := t.GET(req)
 	if err != nil {

diff --git a/internal/transport/derefmedia.go b/internal/transport/derefmedia.go
@@ -36,7 +36,6 @@ func (t *transport) DereferenceMedia(ctx context.Context, iri *url.URL) (io.Read
 		return nil, 0, err
 	}
 	req.Header.Add("Accept", "*/*") // we don't know what kind of media we're going to get here
-	req.Header.Set("Host", iri.Host)
 
 	// Perform the HTTP request
 	rsp, err := t.GET(req)

diff --git a/internal/transport/finger.go b/internal/transport/finger.go
@@ -68,7 +68,6 @@ func prepWebfingerReq(ctx context.Context, loc, domain, username string) (*http.
 	// including Gin itself. So concat the accept header with a comma
 	// instead which seems to work reliably
 	req.Header.Add("Accept", string(apiutil.AppJRDJSON)+","+string(apiutil.AppJSON))
-	req.Header.Set("Host", req.URL.Host)
 
 	return req, nil
 }
@@ -187,7 +186,6 @@ func (t *transport) webfingerFromHostMeta(ctx context.Context, targetDomain stri
 	// We're doing XML
 	req.Header.Add("Accept", string(apiutil.AppXML))
 	req.Header.Add("Accept", "application/xrd+xml")
-	req.Header.Set("Host", req.URL.Host)
 
 	// Perform the HTTP request
 	rsp, err := t.GET(req)