net/http: incorrectly redirect (301) if request payload include port number

[whswork]

What version of Go are you using (go version)?

$ go version
go version go1.18 linux/arm64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="arm64"
GOBIN=""
GOCACHE="/home/admin/.cache/go-build"
GOENV="/home/admin/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="arm64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/admin/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/admin/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_arm64"
GOVCS=""
GOVERSION="go1.18"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/admin/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3281198030=/tmp/go-build -gno-record-gcc-switches"

What did you do?

server.go

package main

import (
	"io"
	"log"
	"net/http"
)

func main() {
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		io.WriteString(w, "hello world")
	})

	log.Fatal(http.ListenAndServe(":80", nil))
}

client.go

package main

import (
	"bufio"
	"fmt"
	"io"
	"log"
	"net"
)

func main() {
	// conn, err := net.Dial("tcp", "1.1.1.1:80")
	conn, err := net.Dial("tcp", "127.0.0.1:80")
	if err != nil {
		log.Fatal(err)
	}
	defer conn.Close()

	var payload = "GET localhost:80 HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n"

	_, err = conn.Write([]byte(payload))
	if err != nil {
		log.Fatal(err)
	}

	reader := bufio.NewReader(conn)

	for {
		message, err := reader.ReadString('\n')
		fmt.Print(message)

		if err == io.EOF {
			break
		}
	}
}

What did you expect to see?

HTTP/1.1 400 Bad Request

What did you see instead?

HTTP/1.1 301 Moved Permanently

[mknyszek]

CC @neild

[mknyszek]

Is this issue new in 1.18, or does it reproduce with older releases?

[whswork]

exists in go1.17.8 windows/amd64 too

[seankhliao]

The authority form is only valid for CONNECT, looks like with other methods, net/http just passes the url straight to net/url.ParseRequestURI which parses localhost:80 as scheme: localhost and opaque: 80. Without a parse error, net/http doesn't return a BadRequest.

[neild]

Is this actually a problem? And if so, what should the correct behavior be?

The surprise is that you can provide a URL with a non-http scheme as the request-target of GET. Given that, is the current behavior wrong?

[seankhliao]

The correct behavior is probably to reject the request like we do if the request line doesn't contain a port. RFC 7230 Section 5.3.3 says the authority form is only used for CONNECT.

request line	current behavior
CONNECT localhost HTTP/1.1	accepted
CONNECT localhost:80 HTTP/1.1	accepted
GET localhost HTTP/1.1	400 Bad Request
GET localhost:80 HTTP/1.1	301 Moved Permanently