Skip to content

fix: 🐛 request.url getter fails when using IPv6 and HTTP2 [#4560] #4559

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Marsup merged 3 commits into from
Mar 6, 2026
+43 −2
Merged

fix: 🐛 request.url getter fails when using IPv6 and HTTP2 [#4560] #4559

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4f47a71
fix: 🐛 request.url getter fails when using HTTP2 and IPv6
gsoldevila Nov 7, 2025
93f29a0
test: add coverage for :authority header fallback and IPv6 URL building
gsoldevila Feb 27, 2026
170a005
perf: use regex test for IPv6 detection in _isBareIpv6
gsoldevila Mar 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions lib/request.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,7 +184,9 @@ exports = module.exports = internals.Request = class {
return url;
}

this._url = new Url.URL(`${this._core.info.protocol}://${this.info.host || `${this._core.info.host}:${this._core.info.port}`}${source}`);
const host = this.info.host || this._formatIpv6Host(this._core.info.host, this._core.info.port);

this._url = new Url.URL(`${this._core.info.protocol}://${host}${source}`);
}
else {

Expand All @@ -201,6 +203,18 @@ exports = module.exports = internals.Request = class {
return this._url;
}

_isBareIpv6(host) {

// An IPv6 address contains at least two colons.

return (host.match(/:/g) || []).length >= 2;
Copy link
Copy Markdown
Contributor

@Marsup Marsup Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this function is in a hot path, I'd favor a more performant alternative. Having tried a few in this benchmark, the regex for the test version seems consistently better both for the positive and negative scenarios. Let me know if my benchmark is biased though.

Copy link
Copy Markdown
Contributor Author

@gsoldevila gsoldevila Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, and thanks for the benchmark! I've validated that /:[^:]*:/ is semantically equivalent to the previous colon-count approach — a string has two or more colons if and only if it contains two colons with zero or more non-colon characters between them, which is exactly what this regex matches.

I've applied it in 170a005. One small note: I omitted the g flag from the benchmark's /:[^:]*:/g since .test() with g advances lastIndex on a shared regex, which can cause subtle bugs. Since we're using it as an inline literal the impact is zero here, but it's cleaner to leave it out.

}

_formatIpv6Host(host, port) {

return this._isBareIpv6(host) ? `[${host}]:${port}` : `${host}:${port}`;
}

_normalizePath(url, options) {

let path = this._core.router.normalize(url.pathname);
Expand Down Expand Up @@ -624,7 +638,7 @@ internals.Info = class {
this._request = request;

const req = request.raw.req;
const host = req.headers.host ? req.headers.host.trim() : '';
const host = (req.headers.host || req.headers[':authority'] || '').trim();
Copy link
Copy Markdown
Contributor Author

@gsoldevila gsoldevila Nov 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps we could test if the req is an IPv6 request somehow, and choose Host or :authority accordingly. WDYT?

Copy link
Copy Markdown
Contributor

@damusix damusix Nov 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that would be great and expect if we want this included. I've done some light digging and come up with the following to help this along:

https://github.com/hapijs/hapi/blob/master/lib/core.js#L334 listens for whatever host / address you pass it, you can set it to loopback :: to bind to ipv6

Test it using builtins that only request IPv6

const http = require('http');

const options = {
    hostname: '::1', // The IPv6 loopback address of your local server
    port: 3000,
    path: '/',
    method: 'GET',
    family: 6 // Force IPv6
};

const req = http.request(options, (res) => {
    console.log(`STATUS: ${res.statusCode}`);
    res.setEncoding('utf8');
    res.on('data', (chunk) => {
        console.log(`BODY: ${chunk}`);
    });
});

req.on('error', (e) => {
    console.error(`problem with request: ${e.message}`);
});

req.end();

or alternatively, reuse some of the patterns in hapi tests: https://github.com/hapijs/hapi/blob/master/test/core.js#L925

The right place to add those tests would be https://github.com/hapijs/hapi/blob/master/test/core.js

Checkout some of the commentary around ipv6:

https://github.com/hapijs/hapi/blob/master/test/core.js#L102
https://github.com/hapijs/hapi/blob/master/test/core.js#L711

Seems like there's no explicit ipv6 tests, and they would need to be done only if the host machine has ipv6 enabled to prevent false positives.

Hope this helps!

@Marsup @kanongil anything to add or correct on the above?

const received = Date.now();

this.received = received;
Expand Down
27 changes: 27 additions & 0 deletions test/request.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -333,6 +333,16 @@ describe('Request', () => {
expect(res.payload).to.equal('shot');
});

it('sets host info from :authority header when host header is absent', async () => {

const server = Hapi.server();
server.route({ method: 'GET', path: '/', handler: (request) => `${request.info.host}|${request.info.hostname}` });

const res = await server.inject({ url: '/', headers: { host: '', ':authority': 'example.com:8080' } });
expect(res.statusCode).to.equal(200);
expect(res.result).to.equal('example.com:8080|example.com');
});

it('generates unique request id', async () => {

const server = Hapi.server();
Expand Down Expand Up @@ -1735,6 +1745,23 @@ describe('Request', () => {
expect(res.statusCode).to.equal(200);
expect(res.result).to.equal('/test');
});

it('generates valid URL when server host is IPv6 and host header is absent', async () => {

const server = Hapi.server({ host: '::1' });

const handler = (request) => {

delete request.info.host;
expect(request._url).to.not.exist();
return request.url.host;
};

server.route({ path: '/test', method: 'GET', handler });
const res = await server.inject('/test');
expect(res.statusCode).to.equal(200);
expect(res.result).to.match(/^\[::1\]:\d+$/);
});
});

describe('_tap()', () => {
Expand Down