{"abstract":"Proxy host header follows upstream authority not downstream host.","category":"Proxy forwarding","checks":4,"contract":"Given url, downstream, preserve, proxy host header follows upstream authority not downstream host. Return the protocol decision or transformed value; fields are validated and fixtures state boundary outcomes.","evaluation_group":"xh-proxy-host-header-follows-upstream-authority-not-downstream-host","failed_approach":"The attempted repair uses `urlsplit(url).hostname` and still violates a separate fixture.","family":"xh-proxy-host-header-follows-upstream-authority-not-downstream-host","id":"FA-6981","implementations":{"attempt":{"sha256":"cabcb5c52d441e343c594653c1c78b7b57a0bdfef935088ce4ed32dd4034d09e","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(url, downstream, preserve):\n    return urlsplit(url).hostname\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('https://up:8443/a', 'down', False), 'up:8443')\", \"check('fixture 2', solve('https://up/a', 'down', True), 'down')\", \"check('fixture 3', solve('https://up/a', 'down', False), 'up')\", \"check('fixture 4', solve('http://up:80/a', 'down', False), 'up:80')\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"broken":{"sha256":"b3b124ae982aaaf551edb155f1d6730e6a78edbf25dab0cd4cb6d898a9e1175a","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(url, downstream, preserve):\n    return downstream\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('https://up:8443/a', 'down', False), 'up:8443')\", \"check('fixture 2', solve('https://up/a', 'down', True), 'down')\", \"check('fixture 3', solve('https://up/a', 'down', False), 'up')\", \"check('fixture 4', solve('http://up:80/a', 'down', False), 'up:80')\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"},"fixed":{"sha256":"25090747bf367ccecf23ed4d47ebb4fc50eaeff500b6d351d662ee53a57dde16","source":"\"\"\"Failure Map reference implementation. Python standard library only.\"\"\"\nimport json\nimport ipaddress\nimport re\nfrom urllib.parse import urlsplit, urljoin\nN = 1\nobservations = []\ndef solve(url, downstream, preserve):\n    return downstream if preserve else (urlsplit(url).hostname + (\":\"+str(urlsplit(url).port) if urlsplit(url).port is not None else \"\"))\ndef check(label, actual, expected):\n    observations.append({\"check\": label, \"actual\": actual, \"expected\": expected, \"passed\": actual == expected})\n_fixtures = [\"check('fixture 1', solve('https://up:8443/a', 'down', False), 'up:8443')\", \"check('fixture 2', solve('https://up/a', 'down', True), 'down')\", \"check('fixture 3', solve('https://up/a', 'down', False), 'up')\", \"check('fixture 4', solve('http://up:80/a', 'down', False), 'up:80')\"]\nfor _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:\n    exec(_line)\nprint(json.dumps({\"observations\": observations, \"passed\": all(x[\"passed\"] for x in observations)}, ensure_ascii=False))\nraise SystemExit(0 if all(x[\"passed\"] for x in observations) else 1)\n"}},"limitations":"Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.","method":"Deterministic executable model with adversarial boundary fixtures.","provenance":{"created_by":"Failure Map","dependencies":"Python standard library","family":"xh-proxy-host-header-follows-upstream-authority-not-downstream-host","generated_at":"2026-09-29T14:38:07.204082+00:00","license":"CC0-1.0","python":"3.12.14","seed":1,"split":"open-access"},"relevance":"This deterministic proxy forwarding model isolates the proxy-host-header-follows-upstream-authority-not-downstream-host policy at a network component boundary.","repair":"Apply the explicit proxy-host-header-follows-upstream-authority-not-downstream-host contract, including the tested boundary and negative cases.","root_cause":"The faulty implementation uses `downstream` for the proxy-host-header-follows-upstream-authority-not-downstream-host decision.","sha256":"3de1010de9f75986abad83ab7437e43928548006d981cbd93a26dcf4ad0ba0b5","title":"Proxy host header follows upstream authority not downstream host · case 01","variant":1,"variant_policy":"Five numbered records share a model and may reuse boundary fixtures.","verification":{"attempt":{"elapsed_ms":33.828,"exit_code":1,"observations":[{"actual":"up","check":"fixture 2","expected":"down","passed":false},{"actual":"up","check":"fixture 3","expected":"up","passed":true},{"actual":"up","check":"fixture 4","expected":"up:80","passed":false},{"actual":"up","check":"fixture 1","expected":"up:8443","passed":false}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": \"up\", \"expected\": \"down\", \"passed\": false}, {\"check\": \"fixture 3\", \"actual\": \"up\", \"expected\": \"up\", \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": \"up\", \"expected\": \"up:80\", \"passed\": false}, {\"check\": \"fixture 1\", \"actual\": \"up\", \"expected\": \"up:8443\", \"passed\": false}], \"passed\": false}\n"},"broken":{"elapsed_ms":34.49,"exit_code":1,"observations":[{"actual":"down","check":"fixture 2","expected":"down","passed":true},{"actual":"down","check":"fixture 3","expected":"up","passed":false},{"actual":"down","check":"fixture 4","expected":"up:80","passed":false},{"actual":"down","check":"fixture 1","expected":"up:8443","passed":false}],"passed":false,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": \"down\", \"expected\": \"down\", \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": \"down\", \"expected\": \"up\", \"passed\": false}, {\"check\": \"fixture 4\", \"actual\": \"down\", \"expected\": \"up:80\", \"passed\": false}, {\"check\": \"fixture 1\", \"actual\": \"down\", \"expected\": \"up:8443\", \"passed\": false}], \"passed\": false}\n"},"fixed":{"elapsed_ms":35.061,"exit_code":0,"observations":[{"actual":"down","check":"fixture 2","expected":"down","passed":true},{"actual":"up","check":"fixture 3","expected":"up","passed":true},{"actual":"up:80","check":"fixture 4","expected":"up:80","passed":true},{"actual":"up:8443","check":"fixture 1","expected":"up:8443","passed":true}],"passed":true,"stderr":"","stdout":"{\"observations\": [{\"check\": \"fixture 2\", \"actual\": \"down\", \"expected\": \"down\", \"passed\": true}, {\"check\": \"fixture 3\", \"actual\": \"up\", \"expected\": \"up\", \"passed\": true}, {\"check\": \"fixture 4\", \"actual\": \"up:80\", \"expected\": \"up:80\", \"passed\": true}, {\"check\": \"fixture 1\", \"actual\": \"up:8443\", \"expected\": \"up:8443\", \"passed\": true}], \"passed\": true}\n"}},"verified":true,"visibility":"public"}