Hynek Schlawack17h ago

speaking of Sentry: y'all might want to add a "werkzeug!=3.1.7" pin if you run Werkzeug (maybe via Flask) in a cluster with weird hostnames:

https://github.com/pallets/werkzeug/issues/3141

3.1.7 version introduces a BC break in host validation · Issue #3141 · pallets/werkzeug

A feature to validate host http header no matter what introduces backwards compatibility break. The bug presents itself by regarding the host invalid (false-positive) A host like 069ef83c8f81497b8e...

GitHub
Show threadDavid Lord 15h ago
@hynek what I'm not clear on is how Django has been doing this same check for 15 years. People must be deploying Django on AWS.
Show threadHynek Schlawack
@davidism btw, I've checked and my problem is actually that my Host header is empty when pinged by Nomad/Consul’s health checker. If I get to it, I'll comment on the discussion later, but as heads up that this might be rather common.
3:08pmMona for Mac
Show threadGlyph13h ago
@hynek @davidism as I have recently learned we can’t even sunset TELNET so HTTP/0.9 seems like it’s here to stay too
Show threadDavid Lord 12h ago
@glyph @hynek Thanks both of you, these two comments helped me figure out what was going on: https://github.com/pallets/werkzeug/issues/3142
`get_host` should allow empty host · Issue #3142 · pallets/werkzeug

#3113 updated get_host to always validate the host characters. However, it also disallowed the empty string. This is a bit too strict, it should only validate the string if it's not empty, or if tr...

GitHub