cpprestsdk
cpprestsdk copied to clipboard
[http_client] CN checking against caller-specified Host header doesn't strip a port number
Related to #832.
Both calc_cn_host in cpprestsdk/Release/src/http/client/http_client_asio.cpp and winhttp_client::send_request in cpprestsdk/Release/src/http/client/http_client_winhttp.cpp cause the entire Host header value to be compared with the certificate Common Name which causes an SSL handshake error if the caller passes a Host header including a port number, e.g. when non-default.
https://github.com/microsoft/cpprestsdk/blob/411a109150b270f23c8c97fa4ec9a0a4a98cdecf/Release/src/http/client/http_client_asio.cpp#L103
https://github.com/microsoft/cpprestsdk/blob/411a109150b270f23c8c97fa4ec9a0a4a98cdecf/Release/src/http/client/http_client_winhttp.cpp#L1110