[pull] master from home-assistant:master#386
Merged
Merged
Conversation
HTTP/3 clients send an :authority pseudo-header instead of a literal Host header. Unlike for HTTP/2, nginx does not populate $http_host from :authority for HTTP/3 (see nginx/nginx#455), so "proxy_set_header Host $http_host;" evaluates to an empty value and nginx omits the Host header on the upstream request entirely. The same applies to X-Forwarded-Host. Home Assistant 2026.7.0 ships aiohttp 3.14, which enforces RFC 9112 section 3.2: an HTTP/1.1 request without a Host header is rejected with 400 "Missing 'Host' header in request" (aio-libs/aiohttp#12264). Since the proxy speaks HTTP/1.1 upstream, HTTP/3 clients started receiving 400 errors. The common fix is to use $host instead (as e.g. Authelia recommends, authelia/authelia#7146), which falls back to :authority and then server_name and is therefore never empty. However, $host is normalized: lowercased and with the port stripped. Home Assistant's OAuth2 discovery endpoints (/.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource and the WWW-Authenticate header on 401 responses, used by RFC 8414/9728 discovery, notably by MCP connectors) match the request host *and port* against the configured external URL. With plain $host, an external URL on a non-default port would never match again, regressing such setups. Instead, map the client's Host header verbatim ($http_host, which preserves the port) and fall back to $host only when it is empty. This keeps HTTP/1.1 and HTTP/2 behavior byte-for-byte unchanged and fixes the missing Host header for HTTP/3. Known limitation: for HTTP/3 clients the port is still lost in the fallback, as nginx exposes no variable carrying the full :authority. HTTP/3 combined with a non-default external port therefore still cannot pass the OAuth discovery port match; this is unfixable at the proxy layer until nginx populates the Host header from :authority for HTTP/3 as well. Fixes #4680 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )