bug #38368 [HttpClient] Fix using https with proxies (bohanyang)

nicolas-grekas · nicolas-grekas · commit abe0ecac919e · 2020-10-01T18:05:35.000+02:00
This PR was squashed before being merged into the 4.4 branch. Discussion ---------- [HttpClient] Fix using https with proxies | Q | A | ------------- | --- | Branch? | 4.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | License | MIT | Doc PR | - According to my test, when `request_fulluri` is set to true, the host appears in the URL will be the Host header, even if the Host header is set in the context http header. Since HttpClient has its own DNS cache, the host inside the URL is usually an IP address. So this can break many things. ``` { "args": {}, "headers": { "Accept": "*/*", "Accept-Encoding": "gzip", "Host": "3.211.1.78", "User-Agent": "Symfony HttpClient/Native", "X-Amzn-Trace-Id": "Root=1-5f75a59e-62c8c81e4490e09c700d6180" }, "origin": "xxx.xxx.xxx.xxx", "url": "https://3.211.1.78/get" } * Hostname was NOT found in DNS cache * Added httpbin.org:0:3.211.1.78 to DNS cache * Establish HTTP proxy tunnel to tcp://10.22.22.21:7777 > GET https://3.211.1.78/get HTTP/1.1 Accept: */* Accept-Encoding: gzip Host: httpbin.org User-Agent: Symfony HttpClient/Native < HTTP/1.1 200 OK < Date: Thu, 01 Oct 2020 09:47:10 GMT < Content-Type: application/json < Content-Length: 300 < Connection: close < Server: gunicorn/19.9.0 < Access-Control-Allow-Origin: * < Access-Control-Allow-Credentials: true < ``` I've also found this guzzle/guzzle#791 We can also create an option to make it customizable. Commits ------- 7e0cd4e [HttpClient] Fix using https with proxies
diff --git a/src/Symfony/Component/HttpClient/NativeHttpClient.php b/src/Symfony/Component/HttpClient/NativeHttpClient.php
@@ -225,7 +225,7 @@ public function request(string $method, string $url, array $options = []): Respo
 
         $resolveRedirect = self::createRedirectResolver($options, $host, $proxy, $noProxy, $info, $onProgress);
         $context = stream_context_create($context, ['notification' => $notification]);
-        self::configureHeadersAndProxy($context, $host, $options['headers'], $proxy, $noProxy);
+        self::configureHeadersAndProxy($context, $host, $options['headers'], $proxy, $noProxy, 'https:' === $url['scheme']);
 
         return new NativeResponse($this->multi, $context, implode('', $url), $options, $info, $resolveRedirect, $onProgress, $this->logger);
     }
@@ -411,14 +411,14 @@ private static function createRedirectResolver(array $options, string $host, ?ar
                 // Authorization and Cookie headers MUST NOT follow except for the initial host name
                 $requestHeaders = $redirectHeaders['host'] === $host ? $redirectHeaders['with_auth'] : $redirectHeaders['no_auth'];
                 $requestHeaders[] = 'Host: '.$host.$port;
-                self::configureHeadersAndProxy($context, $host, $requestHeaders, $proxy, $noProxy);
+                self::configureHeadersAndProxy($context, $host, $requestHeaders, $proxy, $noProxy, 'https:' === $url['scheme']);
             }
 
             return implode('', $url);
         };
     }
 
-    private static function configureHeadersAndProxy($context, string $host, array $requestHeaders, ?array $proxy, array $noProxy)
+    private static function configureHeadersAndProxy($context, string $host, array $requestHeaders, ?array $proxy, array $noProxy, bool $isSsl)
     {
         if (null === $proxy) {
             return stream_context_set_option($context, 'http', 'header', $requestHeaders);
@@ -435,7 +435,7 @@ private static function configureHeadersAndProxy($context, string $host, array $
         }
 
         stream_context_set_option($context, 'http', 'proxy', $proxy['url']);
-        stream_context_set_option($context, 'http', 'request_fulluri', true);
+        stream_context_set_option($context, 'http', 'request_fulluri', !$isSsl);
 
         if (null !== $proxy['auth']) {
             $requestHeaders[] = 'Proxy-Authorization: '.$proxy['auth'];

Original file line number	Diff line number	Diff line change
`@@ -225,7 +225,7 @@ public function request(string $method, string $url, array $options = []): Respo`
`225`	`225`
`226`	`226`	`$resolveRedirect = self::createRedirectResolver($options, $host, $proxy, $noProxy, $info, $onProgress);`
`227`	`227`	`$context = stream_context_create($context, ['notification' => $notification]);`
`228`		`- self::configureHeadersAndProxy($context, $host, $options['headers'], $proxy, $noProxy);`
	`228`	`+ self::configureHeadersAndProxy($context, $host, $options['headers'], $proxy, $noProxy, 'https:' === $url['scheme']);`
`229`	`229`
`230`	`230`	`return new NativeResponse($this->multi, $context, implode('', $url), $options, $info, $resolveRedirect, $onProgress, $this->logger);`
`231`	`231`	`}`
`@@ -411,14 +411,14 @@ private static function createRedirectResolver(array $options, string $host, ?ar`
`411`	`411`	`// Authorization and Cookie headers MUST NOT follow except for the initial host name`
`412`	`412`	`$requestHeaders = $redirectHeaders['host'] === $host ? $redirectHeaders['with_auth'] : $redirectHeaders['no_auth'];`
`413`	`413`	`$requestHeaders[] = 'Host: '.$host.$port;`
`414`		`- self::configureHeadersAndProxy($context, $host, $requestHeaders, $proxy, $noProxy);`
	`414`	`+ self::configureHeadersAndProxy($context, $host, $requestHeaders, $proxy, $noProxy, 'https:' === $url['scheme']);`
`415`	`415`	`}`
`416`	`416`
`417`	`417`	`return implode('', $url);`
`418`	`418`	`};`
`419`	`419`	`}`
`420`	`420`
`421`		`- private static function configureHeadersAndProxy($context, string $host, array $requestHeaders, ?array $proxy, array $noProxy)`
	`421`	`+ private static function configureHeadersAndProxy($context, string $host, array $requestHeaders, ?array $proxy, array $noProxy, bool $isSsl)`
`422`	`422`	`{`
`423`	`423`	`if (null === $proxy) {`
`424`	`424`	`return stream_context_set_option($context, 'http', 'header', $requestHeaders);`
`@@ -435,7 +435,7 @@ private static function configureHeadersAndProxy($context, string $host, array $`
`435`	`435`	`}`
`436`	`436`
`437`	`437`	`stream_context_set_option($context, 'http', 'proxy', $proxy['url']);`
`438`		`- stream_context_set_option($context, 'http', 'request_fulluri', true);`
	`438`	`+ stream_context_set_option($context, 'http', 'request_fulluri', !$isSsl);`
`439`	`439`
`440`	`440`	`if (null !== $proxy['auth']) {`
`441`	`441`	`$requestHeaders[] = 'Proxy-Authorization: '.$proxy['auth'];`