8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190 #25844

jaikiran · 2025-06-17T06:55:38Z

Can I please get a review for this change which addresses a regression that was introduced in HttpURLConnection in Java 24 when we cleaned up the code by removing the references to SecurityManager APIs.

When a HTTP request is issued through java.net.HttpURLConnection, then the request URL is used to determine the Host header to set in the request. By default, the application cannot set a Host header to a different value. However the JDK allows a system property to be enabled to allow applications to explicitly set a Host request header when issuing the request.

Due to an oversight in the change that was done in https://bugs.openjdk.org/browse/JDK-8344190, the Host header that is set by the application, may not get used for that request causing this regression. Turns out we don't have tests in this area to catch this issue.

The commit in this PR fixes the regression and also introduces a new jtreg test which reproduces the issue and verifies the fix.

I've also checked the original change which introduced this regression #22232 to see if there's anything else that needs attention. I haven't stopped anything else.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190 (Bug - P2)

Reviewers

Volkan Yazici (@vy - Committer) 🔄 Re-review required (review applies to 6dc36858)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/25844/head:pull/25844
$ git checkout pull/25844

Update a local copy of the PR:
$ git checkout pull/25844
$ git pull https://git.openjdk.org/jdk.git pull/25844/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 25844

View PR using the GUI difftool:
$ git pr show -t 25844

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/25844.diff

Using Webrev

Link to Webrev Comment

…eader in some cases after JDK-8344190

bridgekeeper · 2025-06-17T06:56:25Z

👋 Welcome back jpai! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2025-06-17T06:57:18Z

❗ This change is not yet ready to be integrated.
See the Progress checklist in the description for automated requirements.

openjdk · 2025-06-17T06:58:02Z

@jaikiran The following label will be automatically applied to this pull request:

net

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2025-06-17T07:00:45Z

Webrevs

vy · 2025-06-17T07:29:23Z

test/jdk/java/net/HttpURLConnection/HostHeaderTest.java

+    static void beforeAll() throws Exception {
+        final InetSocketAddress addr = new InetSocketAddress(InetAddress.getLoopbackAddress(), 0);
+        server = HttpServer.create(addr, 0);
+        server.createContext("/", new Handler());


I think it might be a good idea to salt the handler path a bit (e.g., with the class name) to avoid unexpected connections from tests running in parallel.

Hello Volkan, the server handler in this test is implemented to allow more than one request during its lifetime. So any unexpected requests from other processes would still allow this test to be unaffected by those requests. Did I misunderstand your suggestion for registering the handler to a test specific context?

So any unexpected requests from other processes would still allow this test to be unaffected by those requests.

Yes, this test will not be affected, but the other test might. Consider a test running in parallel, unexpectedly connecting to HostHeaderTest's server, and it is

either not expecting a response at all

or not expecting the response returned from the HostHeaderTest's handler

I've updated the PR to register the handler at a test specific context root. Having said that, I wasn't aware we were doing this in our tests.

We had some tests failing randmonly in the past because they got additional connections from other processes running on the same host (some time other tests). So now we tend to add a bit of salt in the path - it makes it easier to figure out that the strange things you see in the logs were not caused by a legit client. Also if you see 404 being returned and you know that your custom handler never returns 404 then it's easier to figure out that you somehow connected to some other server.

dfuch · 2025-06-17T13:28:07Z

src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java

@@ -621,8 +621,9 @@ private void writeRequests() throws IOException {
            if (port != -1 && port != url.getDefaultPort()) {
                host += ":" + String.valueOf(port);
            }
-            String reqHost = requests.findValue("Host");
-            if (reqHost == null || !reqHost.equalsIgnoreCase(host)) {
+            if (requests.findValue("Host") == null) {


Should we use setIfNotSet here like for "Accept" below?

That seems reasonable. I had a look at the implementation in setIfNotSet() and it matches this current semantic. So I've updated the PR to use setIfNotSet().

dfuch · 2025-06-17T14:13:36Z

test/jdk/java/net/HttpURLConnection/HostHeaderTest.java

@@ -57,6 +57,7 @@
 */
 class HostHeaderTest {

+    private static final String SERVER_CTX_ROOT = "/8359709";


Suggested change

private static final String SERVER_CTX_ROOT = "/8359709";

private static final String SERVER_CTX_ROOT = "/8359709/";

Preferably always terminate context roots with /

https://docs.oracle.com/en/java/javase/24/docs/api/jdk.httpserver/com/sun/net/httpserver/HttpServer.html#createContext(java.lang.String,com.sun.net.httpserver.HttpHandler)

API Note:
The path should generally, but is not required to, end with '/'. If the path does not end with '/', eg such as with "/foo" then this would match requests with a path of "/foobar" or "/foo/bar".

Good point. I've now updated the PR with this change. Test continues to pass.

…handler

jaikiran added 2 commits June 17, 2025 11:38

8359709: introduce a test

8c5bc18

8359709: java.net.HttpURLConnection sends unexpected "Host" request h…

6dc3685

…eader in some cases after JDK-8344190

openjdk bot added the rfr Pull request is ready for review label Jun 17, 2025

openjdk bot added the net [email protected] label Jun 17, 2025

vy approved these changes Jun 17, 2025

View reviewed changes

dfuch reviewed Jun 17, 2025

View reviewed changes

jaikiran added 2 commits June 17, 2025 19:14

Daniel's suggestion - use setIfNotSet

5c65cc7

Volkan's suggestion - use test specific context root for the handler

666f29b

dfuch reviewed Jun 17, 2025

View reviewed changes

Daniel's suggestion - use trailing slash for path registered for the …

419e86b

…handler

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190 #25844

8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190 #25844

jaikiran commented Jun 17, 2025 •

edited by openjdk bot

Loading

Uh oh!

bridgekeeper bot commented Jun 17, 2025

Uh oh!

openjdk bot commented Jun 17, 2025

Uh oh!

openjdk bot commented Jun 17, 2025

Uh oh!

mlbridge bot commented Jun 17, 2025 •

edited

Loading

Uh oh!

vy Jun 17, 2025

Uh oh!

jaikiran Jun 17, 2025

Uh oh!

vy Jun 17, 2025

Uh oh!

jaikiran Jun 17, 2025

Uh oh!

dfuch Jun 17, 2025 •

edited

Loading

Uh oh!

dfuch Jun 17, 2025

Uh oh!

jaikiran Jun 17, 2025

Uh oh!

dfuch Jun 17, 2025 •

edited

Loading

Uh oh!

jaikiran Jun 18, 2025 •

edited

Loading

Uh oh!

Uh oh!

	private static final String SERVER_CTX_ROOT = "/8359709";
	private static final String SERVER_CTX_ROOT = "/8359709/";

8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190 #25844

Are you sure you want to change the base?

8359709: java.net.HttpURLConnection sends unexpected "Host" request header in some cases after JDK-8344190 #25844

Conversation

jaikiran commented Jun 17, 2025 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Progress

Issue

Reviewers

Reviewing

Uh oh!

bridgekeeper bot commented Jun 17, 2025

Uh oh!

openjdk bot commented Jun 17, 2025

Uh oh!

openjdk bot commented Jun 17, 2025

Uh oh!

mlbridge bot commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

vy Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

jaikiran Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

vy Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

jaikiran Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

dfuch Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dfuch Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

jaikiran Jun 17, 2025

Choose a reason for hiding this comment

Uh oh!

dfuch Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jaikiran Jun 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jaikiran commented Jun 17, 2025 •

edited by openjdk bot

Loading

mlbridge bot commented Jun 17, 2025 •

edited

Loading

dfuch Jun 17, 2025 •

edited

Loading

dfuch Jun 17, 2025 •

edited

Loading

jaikiran Jun 18, 2025 •

edited

Loading