cpprestsdk icon indicating copy to clipboard operation
cpprestsdk copied to clipboard

[http_client] CN checking against caller-specified Host header doesn't strip a port number

Open garethsb opened this issue 1 year ago • 0 comments

Related to #832.

Both calc_cn_host in cpprestsdk/Release/src/http/client/http_client_asio.cpp and winhttp_client::send_request in cpprestsdk/Release/src/http/client/http_client_winhttp.cpp cause the entire Host header value to be compared with the certificate Common Name which causes an SSL handshake error if the caller passes a Host header including a port number, e.g. when non-default.

https://github.com/microsoft/cpprestsdk/blob/411a109150b270f23c8c97fa4ec9a0a4a98cdecf/Release/src/http/client/http_client_asio.cpp#L103

https://github.com/microsoft/cpprestsdk/blob/411a109150b270f23c8c97fa4ec9a0a4a98cdecf/Release/src/http/client/http_client_winhttp.cpp#L1110

garethsb avatar Feb 23 '24 09:02 garethsb