Expand my Community achievements bar.

FYI: AEM 6.2 Implements Strict HTTP Host Header Checking

Avatar

Level 3

: Hello All - 

I am posting this in hopes it helps you all in the future.

As part of our upgrade from AEM 6.0 to AEM 6.2, we were stymied by an issue where the load balancer health checks were failing (thus taking the site down) because in the upgrade from 6.0 to 6.2, the Jetty library was updated, and that update included strict HTTP Host Header Checking...which is actually a bug in Jetty as described here: https://github.com/eclipse/jetty.project/issues/592 .

Our F5 load balancer, like many such devices, sends as small a request as possible to health check.  It also connects to our Dispatcher Apache via IP address, and not hostname, resulting in the Host header being empty for healthchecks.  No problem under AEM 6.0, as the bundled Jetty didn't enforce the Host header being present.

As of 6.2 (and maybe 6.1) the Jetty library returns a 400 error if the Host header is empty/null/zero length, so it fails the 'is it up' test from the load balancer.

As a result, our publish instance's error.log was showing thousands of messages like this:

01.11.2016 22:19:26.484 *WARN* [qtp1986744037-3337] org.eclipse.jetty.http.HttpParser badMessage: 400 Bad Host header for HttpChannelOverHttp@1afbf36f{r=0,c=false,a=IDLE,uri=/xxxx/healthcheck}

The F5 team was not able to add the Host header on their side for health checks, so we ended up adding an Apache rule in our dispatcher Apache httpd.conf like this:

<VirtualHost _default_:xx> <Location /xxxx/healthcheck> RequestHeader set Host <our host name> </Location> </VirtualHost>

This made the Host header not null by the time it got to the Publish instance, and thus it returned a 200 OK.

We were unable to deploy our 6.2 upgrade for a long time because of this issue, so I hope that posting it helps someone else!

Cheers,

Tim

1 Reply