WebLogic return Bad Request for a empty host header request

user_1209765 0
Viewed 929

I'm trying to call a WebService hosted into a WebLogic server. Everytime I call it with a empty value into the "host" header, I receive a "400 - Bad Request" response. If I put something into the host header, the request is ok and I can consume the WS. The RFC says:

A client MUST include a Host header field in all HTTP/1.1 request messages . If the requested URI does not include an Internet host name for the service being requested, then the Host header field MUST be given with an empty value

When I send the host with empty value, I'm sending the URI without the host name, so, by the RFC, I'm doing ok.

This is my HTTP header that's receiving a Bad Request:

POST /myContent/myWebService HTTP/1.1
SOAPAction: mySOAPcall
Connection: Keep-Alive
Host: 
Content-Type: text/xml;charset=UTF-8
Content-Length: 709

If I put the host, it works fine:

POST http://mydomain.com.br/myContent/myWebService HTTP/1.1
SOAPAction: mySOAPcall
Connection: Keep-Alive
Host: mydomain.com.br
Content-Type: text/xml;charset=UTF-8
Content-Length: 709

Am I missing something into the request with the empty host header?

weblogic post http
1 Answers

Looking at the the RFC specifications, I couldn't find the following quote:

A client MUST include a Host header field in all HTTP/1.1 request messages . If the requested URI does not include an Internet host name for the service being requested, then the Host header field MUST be given with an empty value

However in section 3.2 I found out that:

Invalid whitespace around field-names is now required to be rejected, because accepting it represents a security vulnerability. The ABNF productions defining header fields now only list the field value. (Section 3.2)

https://www.rfc-editor.org/rfc/rfc7230#section-3.2

Could it be possible that the empty value is interpreted as invalid whitespace?

user_77180110
Related