Skip to content

relax get_host strictness#3148

Merged
davidism merged 1 commit intostablefrom
host
Apr 2, 2026
Merged

relax get_host strictness#3148
davidism merged 1 commit intostablefrom
host

Conversation

@davidism
Copy link
Copy Markdown
Member

@davidism davidism commented Apr 2, 2026

If the Host header is missing, such as for HTTP/0.9 and 1.0, or has invalid characters, get_host and Request.host return the empty string. If trusted_hosts is passed, a missing value is allowed, but an invalid value results in an error.

This relaxes the validation a bit, so that empty and invalid values don't cause requests to immediately fail. Subdomain and host routing, and external URL building, will not work though, as they need a host value.

If something is generating invalid hostnames, you need to report a bug to that thing.

fixes #3142

@davidism davidism added this to the 3.1.8 milestone Apr 2, 2026
@davidism davidism linked an issue Apr 2, 2026 that may be closed by this pull request
@davidism davidism merged commit 7926f0b into stable Apr 2, 2026
13 checks passed
@davidism davidism deleted the host branch April 2, 2026 15:36
@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Apr 17, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

get_host should allow empty host

1 participant