net/http/httputil: ReverseProxy The HTTP headers have been forcibly normalized.

[notutensil]

Go version

go 1.23

Output of go env in your module/workspace:

GO111MODULE='on'
GOARCH='arm64'
GOBIN=''
GOCACHE='/root/.cache/go-build'
GOENV='/root/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='arm64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/root/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/root/go'
GOPRIVATE=''
GOPROXY='https://goproxy.cn'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_arm64'
GOVCS=''
GOVERSION='go1.23.0'
GODEBUG=''
GOTELEMETRY='local'
GOTELEMETRYDIR='/root/.config/go/telemetry'
GCCGO='gccgo'
GOARM64='v8.0'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/dev/null'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build489314398=/tmp/go-build -gno-record-gcc-switches'

What did you do?

Original site service:

package main

import (
	"io"
	"log"
	"net/http"
	"flag"
	"os"
	"fmt"
)

func init() {
	log.SetFlags(log.LstdFlags | log.Lshortfile)
}

func main() {
	hostname, err := os.Hostname()
	if err != nil {
		log.Fatal(err)
	}

	title := flag.String("title", hostname, "title for server")
	laddr := flag.String("laddr", ":8080", "listen address")

	flag.Parse()

	helloHandler := func(w http.ResponseWriter, req *http.Request) {
		wh := w.Header()
		wh["token"] = []string{"something token for auth"}
		io.WriteString(w, fmt.Sprintf("Hello, This is %s\n", *title))
	}

	http.HandleFunc("/hello", helloHandler)

	err = http.ListenAndServe(*laddr, nil)
	if err != nil {
		log.Fatal(err)
	}
}

Site proxy service：

package main

import (
    "net/http"
    "net/http/httputil"
    "net/url"
    "log"
)

func main() {
    target, err := url.Parse("http://127.0.0.1:8080")
    if err != nil {
        log.Fatal(err)
    }

    proxy := httputil.NewSingleHostReverseProxy(target)

    http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
        r.Host = target.Host
        r.URL.Scheme = target.Scheme
        r.URL.Host = target.Host

        proxy.ServeHTTP(w, r)
    })

    log.Println("Starting server at :8081")
    if err := http.ListenAndServe(":8081", nil); err != nil {
        log.Fatal(err)
    }
}

What did you see happen?

*   Trying 127.0.0.1:8081...
* Connected to 127.0.0.1 (127.0.0.1) port 8081 (#0)
> GET /hello HTTP/1.1
> Host: 127.0.0.1:8081
> User-Agent: curl/7.76.1
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Content-Length: 19
< Content-Type: text/plain; charset=utf-8
< Date: Mon, 02 Sep 2024 02:45:04 GMT
< Token: something token for auth
< 
Hello, This is sdp
* Connection #0 to host 127.0.0.1 left intact

What did you expect to see?

*   Trying 127.0.0.1:8080...
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> GET /hello HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: curl/7.76.1
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< token: something token for auth
< Date: Mon, 02 Sep 2024 02:29:56 GMT
< Content-Length: 19
< Content-Type: text/plain; charset=utf-8
< 
Hello, This is sdp
* Connection #0 to host 127.0.0.1 left intact

The name of this token should remain unchanged after being proxied, or the programmer should decide whether to normalize it.

[gabyhelp]

Related Issues and Documentation

• No way to retrieve the proxy host name #49007 (closed)
• affected/package: #62521 (closed)
• net/http/httputil: ReverseProxy copyHeader() appends to pre-existing headers instead of overwriting them from target service's response. #66995 (closed)
• net/http: Host Header must not be deleted from http.Request.Header #66454 (closed)
• net/http: bad host for WriteProxy for HTTP schemes #36831 (closed)
• net/httputil: Lost user credentials in reverse proxy requests. #51022 (closed)
• net/http/httputil: NewSingleHostReverseProxy doesn't overwrite req.Host #7618 (closed)
• net/http: enhanced ServerMux routing #65231 (closed)
• net/http/httputil: ReverseProxy does not pass previous headers when upgrade connection #29407 (closed)
• net/http: Request.URL contains only path value when requested via http2 #68365 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[seankhliao]

Duplicate of #37834