Repository navigation
Passing a URL instance with a CONNECT method results in an invalid path #34347
Description
- Version: >=v10.21.0
- Platform: Linux solus 5.6.18-156.current deps: update openssl to 1.0.1j #1 SMP PREEMPT Sun Jun 21 07:16:38 UTC 2020 x86_64 GNU/Linux
- Subsystem: http, https, url
What steps will reproduce the bug?
const http = require('http');
const server = http.createServer();
server.on('connect', (request, stream) => {
console.log(request.url);
stream.end('HTTP/1.1 501 Not Implemented\r\n\r\n');
});
server.listen(error => {
if (error) {
throw error;
}
const url = new URL(`http://localhost:${server.address().port}/example.com`);
const request = http.request(url, {method: 'CONNECT'}).end();
request.once('connect', response => {
response.destroy();
server.close();
});
});How often does it reproduce? Is there a required condition?
Always.
What is the expected behavior?
example.com
What do you see instead?
/example.com
Additional information
There is a workaround for this:
-const request = http.request(url, {method: 'CONNECT'}).end();
+const request = http.request({
+ hostname: url.hostname,
+ port: url.port,
+ path: 'example.com',
+ method: 'CONNECT'
+}).end();/cc @yovanoc
Activity
bnoordhuis commentedon Jul 14, 2020
/example.comis the expected path. Why would you expectexample.com?szmarczak commentedon Jul 14, 2020
https://tools.ietf.org/html/rfc7231#page-30
bnoordhuis commentedon Jul 14, 2020
Right, so what you're asking is that
http.request()special-cases (and validates?) CONNECT requests? The reason I said/example.comis expected is because theURL#pathnameproperty is used as-is.szmarczak commentedon Jul 14, 2020
The point is that it doesn't, but it should IMO :)
Yup, I noticed that.
bnoordhuis commentedon Jul 14, 2020
Shouldn't be a controversial change. Pull request welcome.
preyunk commentedon Jul 16, 2020
@bnoordhuis
I think we could exclude '/' from pathname at the time of conversion of
urltooptionsor should we changeurl.pathnameto give out the value without '/'.szmarczak commentedon Jul 16, 2020
@preyunk That doesn't seem right.
urlToOptionsjust converts theURLinstance to an object, so it's expected to have leading slash in the pathname. It's just that it shouldn't be emitted when sending a CONNECT request.preyunk commentedon Jul 16, 2020
@szmarczak
Ok I get it now.
How about we check if
options.pathproperty has a leading slash (to prevent cases where it is set explicitly by providing path property in options) for 'CONNECT' method, then slice it to do the needful.szmarczak commentedon Jul 16, 2020
That's what's this issue is about...
http: fixed invalid path with connect method
http: fixed invalid path with connect method
http: fixed invalid path with connect method
github-actions commentedon Jun 27, 2026
This issue has been marked as stale due to 210 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.
drake90001 commentedon Jul 24, 2026
Fox this please because shits still broken