From: Willy Tarreau <w@1wt.eu>
Date: Thu, 6 Aug 2026 08:03:28 +0000 (+0200)
Subject: BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=29fa2667a00a75d3b26bba6ec5bd870e941e95d2;p=thirdparty%2Fhaproxy.git

BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server

The H2 mux properly drops userinfo from authority on input but doesn't
drop it on output if present on input (e.g. coming from H1), which will
cause a bad request when reaching a compliant H2 server such as itself.
Let's make sure it is properly dropped there as well, as required by
RFC9113. This should be backported to all stable versions.

Reported-by: Claude (ANT-2026-R03JNY63)
---

diff --git a/src/mux_h2.c b/src/mux_h2.c
index 6b1dcbc3f..937d5f4db 100644
--- a/src/mux_h2.c
+++ b/src/mux_h2.c
@@ -7111,6 +7111,7 @@ static size_t h2s_snd_bhdrs(struct h2s *h2s, struct htx *htx)
 		 * from rfc 8441.
 		 */
 		struct ist scheme = { };
+		struct ist at;
 
 		if (uri.ptr[0] != '/' && uri.ptr[0] != '*') {
 			/* the URI seems to start with a scheme */
@@ -7130,6 +7131,11 @@ static size_t h2s_snd_bhdrs(struct h2s *h2s, struct htx *htx)
 					auth.len++;
 
 				uri = istadv(uri, auth.len);
+
+				/* RFC9113#8.3.1: :authority must not carry the deprecated userinfo */
+				at = istfind(auth, '@');
+				if (istlen(at))
+					auth = istadv(at, 1);
 			}
 		}