From 8ea6eb5108f72f40975a812fa084703b21198cb4 Mon Sep 17 00:00:00 2001 From: Andrew Clayton Date: Sat, 13 Dec 2025 07:05:27 +0000 Subject: [PATCH] Uwsgi: ensure HTTP_HOST is set to the requested target host. Previously, the HTTP_HOST environment variable was constructed from the Host request header field, which doesn't work well with HTTP/2 and HTTP/3 where Host may be supplanted by the ":authority" pseudo-header field per RFC 9110, section 7.2. Also, it might give an incorrect HTTP_HOST value from HTTP/1.x requests given in the absolute form, in which case the Host header must be ignored by the server, per RFC 9112, section 3.2.2. The fix is to redefine the HTTP_HOST default from a protocol-specific value given in the $host variable. This will now use the Host request header field, ":authority" pseudo-header field, or request line target URI depending on request HTTP version. Also the CGI specification (RFC 3875, 4.1.18) notes The server SHOULD set meta-variables specific to the protocol and scheme for the request. Interpretation of protocol-specific variables depends on the protocol version in SERVER_PROTOCOL. --- src/http/modules/ngx_http_uwsgi_module.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c index c1d0035cc..2f64d745d 100644 --- a/src/http/modules/ngx_http_uwsgi_module.c +++ b/src/http/modules/ngx_http_uwsgi_module.c @@ -629,9 +629,18 @@ static ngx_str_t ngx_http_uwsgi_hide_headers[] = { }; +static ngx_keyval_t ngx_http_uwsgi_headers[] = { + { ngx_string("HTTP_HOST"), + ngx_string("$host$is_request_port$request_port") }, + { ngx_null_string, ngx_null_string } +}; + + #if (NGX_HTTP_CACHE) static ngx_keyval_t ngx_http_uwsgi_cache_headers[] = { + { ngx_string("HTTP_HOST"), + ngx_string("$host$is_request_port$request_port") }, { ngx_string("HTTP_IF_MODIFIED_SINCE"), ngx_string("$upstream_cache_last_modified") }, { ngx_string("HTTP_IF_UNMODIFIED_SINCE"), ngx_string("") }, @@ -1995,7 +2004,8 @@ ngx_http_uwsgi_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child) conf->params_source = prev->params_source; } - rc = ngx_http_uwsgi_init_params(cf, conf, &conf->params, NULL); + rc = ngx_http_uwsgi_init_params(cf, conf, &conf->params, + ngx_http_uwsgi_headers); if (rc != NGX_OK) { return NGX_CONF_ERROR; }