From 29fa2667a00a75d3b26bba6ec5bd870e941e95d2 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Thu, 6 Aug 2026 10:03:28 +0200 Subject: [PATCH] BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server The H2 mux properly drops userinfo from authority on input but doesn't drop it on output if present on input (e.g. coming from H1), which will cause a bad request when reaching a compliant H2 server such as itself. Let's make sure it is properly dropped there as well, as required by RFC9113. This should be backported to all stable versions. Reported-by: Claude (ANT-2026-R03JNY63) --- src/mux_h2.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/mux_h2.c b/src/mux_h2.c index 6b1dcbc3f..937d5f4db 100644 --- a/src/mux_h2.c +++ b/src/mux_h2.c @@ -7111,6 +7111,7 @@ static size_t h2s_snd_bhdrs(struct h2s *h2s, struct htx *htx) * from rfc 8441. */ struct ist scheme = { }; + struct ist at; if (uri.ptr[0] != '/' && uri.ptr[0] != '*') { /* the URI seems to start with a scheme */ @@ -7130,6 +7131,11 @@ static size_t h2s_snd_bhdrs(struct h2s *h2s, struct htx *htx) auth.len++; uri = istadv(uri, auth.len); + + /* RFC9113#8.3.1: :authority must not carry the deprecated userinfo */ + at = istfind(auth, '@'); + if (istlen(at)) + auth = istadv(at, 1); } } -- 2.47.3