FA-6981 / Proxy forwarding / Open access
Proxy host header follows upstream authority not downstream host · case 01
Proxy host header follows upstream authority not downstream host.
ROOT CAUSE
The faulty implementation uses `downstream` for the proxy-host-header-follows-upstream-authority-not-downstream-host decision.
VERIFIED REPAIR
Apply the explicit proxy-host-header-follows-upstream-authority-not-downstream-host contract, including the tested boundary and negative cases.
Unsuccessful approach: The attempted repair uses `urlsplit(url).hostname` and still violates a separate fixture.
Case contract
Given url, downstream, preserve, proxy host header follows upstream authority not downstream host. Return the protocol decision or transformed value; fields are validated and fixtures state boundary outcomes.
Why this case matters
This deterministic proxy forwarding model isolates the proxy-host-header-follows-upstream-authority-not-downstream-host policy at a network component boundary.
1 / The failure
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(url, downstream, preserve):
return downstream
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('https://up:8443/a', 'down', False), 'up:8443')", "check('fixture 2', solve('https://up/a', 'down', True), 'down')", "check('fixture 3', solve('https://up/a', 'down', False), 'up')", "check('fixture 4', solve('http://up:80/a', 'down', False), 'up:80')"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 2 | down | down | Passed |
| fixture 3 | down | up | Failed |
| fixture 4 | down | up:80 | Failed |
| fixture 1 | down | up:8443 | Failed |
SHA-256 / b3b124ae982aaaf551edb155f1d6730e6a78edbf25dab0cd4cb6d898a9e1175a
2 / The unsuccessful fix
Exit 1"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(url, downstream, preserve):
return urlsplit(url).hostname
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('https://up:8443/a', 'down', False), 'up:8443')", "check('fixture 2', solve('https://up/a', 'down', True), 'down')", "check('fixture 3', solve('https://up/a', 'down', False), 'up')", "check('fixture 4', solve('http://up:80/a', 'down', False), 'up:80')"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 2 | up | down | Failed |
| fixture 3 | up | up | Passed |
| fixture 4 | up | up:80 | Failed |
| fixture 1 | up | up:8443 | Failed |
SHA-256 / cabcb5c52d441e343c594653c1c78b7b57a0bdfef935088ce4ed32dd4034d09e
3 / The verified repair
Exit 0"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(url, downstream, preserve):
return downstream if preserve else (urlsplit(url).hostname + (":"+str(urlsplit(url).port) if urlsplit(url).port is not None else ""))
def check(label, actual, expected):
observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('https://up:8443/a', 'down', False), 'up:8443')", "check('fixture 2', solve('https://up/a', 'down', True), 'down')", "check('fixture 3', solve('https://up/a', 'down', False), 'up')", "check('fixture 4', solve('http://up:80/a', 'down', False), 'up:80')"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)
| Boundary fixture | Actual | Expected | Outcome |
|---|---|---|---|
| fixture 2 | down | down | Passed |
| fixture 3 | up | up | Passed |
| fixture 4 | up:80 | up:80 | Passed |
| fixture 1 | up:8443 | up:8443 | Passed |
SHA-256 / 25090747bf367ccecf23ed4d47ebb4fc50eaeff500b6d351d662ee53a57dde16
Verification & scope
Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.
Observations recorded using Python 3.12.14 at 2026-09-29T14:38:07.204082+00:00.
Case digest / 3de1010de9f75986abad83ab7437e43928548006d981cbd93a26dcf4ad0ba0b5