Skip to content

fix: rejection host header validation scenarios #2091

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 31 commits into from
May 20, 2025

Conversation

DeagleGross
Copy link
Contributor

@DeagleGross DeagleGross commented May 14, 2025

Now http.sys responds with 400 Bad Request because I set an urlprefix to control the hostname validation on http.sys layer.
For kestrel I added configuration of Microsoft.AspNetCore.HostFiltering.HostFilteringOptions in order to enable a special middleware checking host header.

Both servers behave in same manner now and benchmarks targets host mismatch header properly now

Request example:
image

@DeagleGross DeagleGross self-assigned this May 14, 2025
@DeagleGross DeagleGross requested a review from BrennanConroy May 14, 2025 16:31
@DeagleGross DeagleGross marked this pull request as ready for review May 20, 2025 12:21
@DeagleGross
Copy link
Contributor Author

there is a problem with load machine, investigating (but that should not refer to benchmark), so merging. I will make a follow-up PR if needed

Linux run

application
Max Process CPU Usage (%) 99
Max Cores usage (%) 1,193
Max Global CPU Usage (%) 99
load
Max Process CPU Usage (%) 31
Max Global CPU Usage (%) 43
Requests/sec 322,172
Requests 4,864,243
Bad responses 4,864,243

Windows run

application
Max Process CPU Usage (%) 1
Max Global CPU Usage (%) 8
load
Max Process CPU Usage (%) 99
Requests/sec 2,635
Requests 39,743
Bad responses 39,743

@DeagleGross DeagleGross merged commit 3e7fb8f into aspnet:main May 20, 2025
2 checks passed
@DeagleGross DeagleGross deleted the dmkorolev/rejection branch May 20, 2025 13:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant