Skip to content

Add Lentient flag that prohibits 0 hosts or multiple.#825

Open
Vizonex wants to merge 7 commits intonodejs:mainfrom
Vizonex:strict-header-flag
Open

Add Lentient flag that prohibits 0 hosts or multiple.#825
Vizonex wants to merge 7 commits intonodejs:mainfrom
Vizonex:strict-header-flag

Conversation

@Vizonex
Copy link
Copy Markdown
Contributor

@Vizonex Vizonex commented Apr 8, 2026

Related to #816 I'm trying to figure out how we can stop a multiple or no host request from being accepted as this is a pretty bad issue that isn't just related to aiohttp aio-libs/aiohttp#10600 but affects other users also.
I do however have a pretty good understanding of llparse's architecture since I made a parody of llparse in python as a pypi package. The only thing that really concerns me is if this will actually reject client requests that do not have a host header or have multiple of them hence this being a draft. I may wind up rewriting this all completely.

close #816

Comment thread src/llhttp/http.ts Outdated
@ShogunPanda
Copy link
Copy Markdown
Contributor

One nit, but the PR looks fine in general.
Just add a test and we're good to go!

@Vizonex
Copy link
Copy Markdown
Contributor Author

Vizonex commented Apr 28, 2026

@ShogunPanda I didn't think I would get back when aiohttp already patched a bug but I guess I will go forward with this :)

@Vizonex
Copy link
Copy Markdown
Contributor Author

Vizonex commented Apr 28, 2026

@ShogunPanda I'll add this in just know I don't have clang (Probably should download it to locally run llparse-fixtures). Maybe in the future llparse should look into multi-compiler support example: gcc, msvc?

For now would adding something like this in suffice?

## Multiple Host

HOST_HEADER if not set should not allow multiple headers afterwards.

```http
GET /url HTTP/1.1
host: www.python.org
host: llhttp.org```

Edit: I'll raise my concern about supporting different C compilers here: nodejs/llparse-test-fixture#27 and come up with another PR if I get the time.

@Vizonex Vizonex marked this pull request as ready for review April 28, 2026 15:20
@Vizonex
Copy link
Copy Markdown
Contributor Author

Vizonex commented Apr 28, 2026

I am a little confused with how to get the tests to work correctly I'll see about trying again later this week.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Should there be a way to block requests with multiple hosts or none are sent?

2 participants