request-baskets Add Host header

Add the Host header back into the request headers.

Mar 05 '24 19:03 ZanyMonk

Hi,

This PR is trying to address the issue reported here: #61

See my comment on the issue: unfortunately, Go developers decided to swallow the Host header in their HTTP handling implementation :(

Your PR solves the issue for a subset of the cases and can mislead a client about true value of Host header, which might not be present in the original request at all, or have a different value.

Given the fact that in most of the cases the Request Baskets service would run behind the proxy in order to gain HTTPS capabilities, the suggested logic for completing the Host header might be entirely incorrect.

I'll try to run some tests to see how the logic behaves when a service is behind proxy, and will report my findings.

Cheers, darklynx

Mar 06 '24 09:03 darklynx

Another observation: the current implementation may actually break the request forwarding logic: https://github.com/darklynx/request-baskets/blob/master/baskets.go#L178

I'm not really sure how the Host header might be interpreted by a 3rd party service when a request is forwarded to a totally different domain, such forwarding might be rejected by a recipient or mess up the handling logic 🤔

I would at least extend the headers cleanup logic and remove the Host header.

Mar 06 '24 09:03 darklynx