Method serveHTTP

modules/caddyhttp/server.go:472–512

(w http.ResponseWriter, r *http.Request)

}

func (s *Server) serveHTTP(w http.ResponseWriter, r *http.Request) error {
	// reject very long methods; probably a mistake or an attack
	if len(r.Method) > 32 {
		if s.shouldLogRequest(r) {
			if c := s.accessLogger.Check(zapcore.DebugLevel, "rejecting request with long method"); c != nil {
				c.Write(
					zap.String("method_trunc", r.Method[:32]),
					zap.String("remote_addr", r.RemoteAddr),
				)
			}
		}
		return HandlerError{StatusCode: http.StatusMethodNotAllowed}
	}

	// RFC 9112 section 3.2: "A server MUST respond with a 400 (Bad Request) status
	// code to any HTTP/1.1 request message that lacks a Host header field and to any
	// request message that contains more than one Host header field line or a Host
	// header field with an invalid field value."
	if r.ProtoMajor == 1 && r.ProtoMinor == 1 && r.Host == "" {
		return HandlerError{
			Err:        errors.New("rfc9112 forbids empty Host"),
			StatusCode: http.StatusBadRequest,
		}
	}

	// Drop headers whose names contain `_`: once FastCGI/CGI/FrankenPHP etc. rewrites `-` to
	// `_`, an underscore alias collides with the legitimate hyphenated header
	// and can bypass `forward_auth copy_headers` (GHSA-f59h-q822-g45g).
	for k := range r.Header {
		if strings.ContainsRune(k, '_') {
			delete(r.Header, k)

			if c := s.logger.Check(zapcore.DebugLevel, "dropping header containing underscore"); c != nil {
				c.Write(zap.String("header", k))
			}
		}
	}

	// execute the primary handler chain
	return s.primaryHandlerChain.ServeHTTP(w, r)
}

// wrapPrimaryRoute wraps stack (a compiled middleware handler chain)
// in s.enforcementHandler which performs crucial security checks, etc.