Skip to content

[HttpFoundation] Fixed 'Via' header regex #60547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: 6.4
Choose a base branch
from

Conversation

thecaliskan
Copy link

@thecaliskan thecaliskan commented May 26, 2025

Q A
Branch? 6.4
Bug fix? yes
New feature? no
Deprecations? no
Issues -
License MIT

📝 Purpose

This MR updates the regular expression used to extract the HTTP protocol version from the Via header in the Request::getProtocolVersion() method.

🎯 Summary of Changes

Old regex:

~^(HTTP/)?([1-9]\.[0-9]) ~

This pattern failed to match valid values like HTTP/1.1 or 2.0 when there was no trailing space. As a result, values passed from proxies (e.g., via proxy_set_header Via $server_protocol;) were not detected correctly.

New regex:

~^(HTTP/)?([1-9]\.[0-9])\b~

✅ Benefits

  • Replaces dependency on a trailing space with \b (word boundary), allowing the regex to match both space-terminated and non-space-terminated inputs.
  • Correctly handles common Via header formats such as:
    • HTTP/1.1
    • 2.0
    • HTTP/2.0 nginx-proxy
    • 1.1 custom-hop
  • Ensures compatibility with reverse proxy configurations (e.g., Nginx, Traefik) where the Via header may vary in format.
  • Improves robustness and reliability of HTTP version detection in proxied environments.

@carsonbot
Copy link

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has a contribution guide which I suggest you to read.

In short:

  • Always add tests
  • Keep backward compatibility (see https://symfony.com/bc).
  • Bug fixes must be submitted against the lowest maintained branch where they apply (see https://symfony.com/releases)
  • Features and deprecations must be submitted against the 7.3 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

@carsonbot carsonbot changed the title Fixed 'Via' header regex [HttpFoundation] Fixed 'Via' header regex May 26, 2025
@GromNaN
Copy link
Member

GromNaN commented May 26, 2025

Hello @thecaliskan,
Thank you very much for working on this PR. Since it's a bug fix, it should target the oldest supported version, which is currently 6.4. We can change the target version before merging, but you can also force-push on the branch to apply the commit on top of the branch 6.4.

In order to have all the information we need if we ever work on this part of the code again later, could you tell us the exact scenario in which you encountered the problem? Which proxy server do you use?

@thecaliskan thecaliskan changed the base branch from 7.2 to 6.4 May 26, 2025 09:14
@thecaliskan
Copy link
Author

Hello @GromNaN,
Thank you for the feedback! 🙏

I’ve updated the PR to target the 6.4 branch as requested and force-pushed the changes accordingly.

The issue was encountered while running the application behind Nginx as a reverse proxy. Specifically, the problem is related to detecting the protocol version used between the client and the proxy.

In Nginx, the Via header can be forwarded using the following configuration:

proxy_set_header Via $server_protocol;

This results in headers such as:

Via: HTTP/2.0

or

`Via: HTTP/1.1`

depending on the protocol version. The Symfony code tries to parse this value using a regular expression, but the original regex expected a trailing space, which is not present in Nginx’s output. This causes the match to fail and fall back to the default SERVER_PROTOCOL.

This PR adjusts the regular expression to support both variants, with or without a trailing space, to ensure compatibility with real-world proxy headers such as those set by Nginx.

📚 Reference:

Let me know if you'd like me to include a test case or further clarify anything.

Thanks again!

@MatTheCat
Copy link
Contributor

Via: HTTP/2.0 looks invalid since it doesn’t include a pseudonym. https://httpwg.org/specs/rfc9110.html#field.via says it’s required.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants