🐛 bug: reject empty normalized host before dynamic matching

[gaby]

Motivation

• A recent change removed the unconditional rejection of an empty normalized Host, allowing empty or malformed effective hosts (e.g. Host: :443, missing Host header, empty trusted X-Forwarded-Host first element) to reach AllowedHostsFunc, which can cause authorization bypasses or panics.
• Restore the previous RFC-compliant behavior that rejects requests with missing/empty host before invoking any dynamic validator.

Description

• Reintroduced an explicit empty-host guard in middleware/hostauthorization.New that calls cfg.ErrorHandler(c, ErrForbiddenHost) when normalizeHost(c.Hostname()) is empty.
• Added a regression test Test_HostAuthorization_AllowedHostsFunc_EmptyHostRejectedBeforeCallback that asserts Host: :443 is rejected with 403 and that AllowedHostsFunc is not invoked.
• Files changed: middleware/hostauthorization/hostauthorization.go and middleware/hostauthorization/hostauthorization_test.go.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: af33b20c-2b33-4d2a-a1e9-50af867a1ead

📥 Commits

Reviewing files that changed from the base of the PR and between 4738308 and a06af3d.

📒 Files selected for processing (2)

• middleware/hostauthorization/hostauthorization.go
• middleware/hostauthorization/hostauthorization_test.go

---

Walkthrough

The host-authorization middleware now performs early validation of the normalized request hostname. When the normalized hostname is empty, the middleware immediately rejects the request with ErrForbiddenHost before proceeding to host matching or invoking any user-supplied callbacks. A test case confirms this rejection occurs and prevents callback execution.

Changes

Empty Hostname Validation

Layer / File(s)	Summary
Empty hostname rejection and test middleware/hostauthorization/hostauthorization.go, middleware/hostauthorization/hostauthorization_test.go	Middleware adds an early guard that rejects requests when normalizeHost(c.Hostname()) returns empty, preventing any host matching or callback logic from executing. Test validates the 403 Forbidden response and confirms AllowedHostsFunc is not invoked.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• gofiber/fiber#4012: Affects how Fiber derives the request hostname from headers, which can change the normalizeHost(c.Hostname()) result that this PR now validates.
• gofiber/fiber#4199: Introduced the same host-authorization middleware with host normalization logic that this PR now guards with early empty-host rejection.

Suggested labels

☢️ Bug, v3, 📜 RFC Compliance

Suggested reviewers

• sixcolors
• ReneWerner87

Poem

🐰 A guard stands tall at the gate so wide,
Rejects the empty hosts with fiber pride,
No callbacks called when hostnames fail,
Security assured without travail! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main fix: rejecting empty normalized hosts before dynamic matching, addressing a security vulnerability.
Description check	✅ Passed	The description covers motivation, implementation details, and testing but lacks explicit coverage of several template sections like benchmarks, documentation updates, and changelog entries.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-vulnerability-allowing-empty-hosts

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Restores stricter Host header handling in the hostauthorization middleware by rejecting requests whose normalized hostname is empty before any dynamic allowlist callback is evaluated, preventing potential bypasses/panics from malformed effective hosts.

Changes:

• Reintroduced an explicit host == "" guard in middleware/hostauthorization.New() to immediately reject empty normalized hosts via the configured ErrorHandler.
• Added a regression test ensuring Host: :443 is rejected with 403 and that AllowedHostsFunc is not invoked.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
middleware/hostauthorization/hostauthorization.go	Adds an early empty-normalized-host rejection prior to matchHost / AllowedHostsFunc.
middleware/hostauthorization/hostauthorization_test.go	Adds a regression test covering empty-host rejection before dynamic matching callbacks.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.32%. Comparing base (4738308) to head (a06af3d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4291   +/-   ##
=======================================
  Coverage   91.32%   91.32%           
=======================================
  Files         132      132           
  Lines       12931    12933    +2     
=======================================
+ Hits        11809    11811    +2     
  Misses        708      708           
  Partials      414      414           

Flag	Coverage Δ
unittests	91.32% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gemini-code-assist]

Code Review

This pull request introduces a check to reject empty hostnames in the host authorization middleware. If the normalized host is empty, the request is immediately rejected with a forbidden error. A new test case has been added to verify that empty hosts are rejected and that the AllowedHostsFunc callback is not executed in such cases. I have no feedback to provide as there were no review comments.