{"record":{"id":"657cb6ccbbb57de7","repo":"kubernetes/kops","slug":"cannot-determine-host","errorCode":null,"errorMessage":"Cannot determine host","messagePattern":"Cannot determine host","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"discovery/pkg/discovery/oidc.go","lineNumber":38,"sourceCode":"\t\"encoding/json\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"strings\"\n\n\t\"k8s.io/klog/v2\"\n\tapi \"k8s.io/kops/discovery/apis/discovery.kops.k8s.io/v1alpha1\"\n)\n\nfunc (s *Server) handleOIDCDiscovery(w http.ResponseWriter, r *http.Request) {\n\tctx := r.Context()\n\tlog := klog.FromContext(ctx)\n\n\tuniverseID := r.PathValue(\"universe\")\n\n\thost := r.Host\n\tif host == \"\" {\n\t\tlog.Info(\"Cannot determine host for OIDC discovery\")\n\t\thttp.Error(w, \"Cannot determine host\", http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tendpoints, err := s.Store.ListDiscoveryEndpoints(r.Context(), universeID)\n\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Error listing endpoints: %v\", err), http.StatusInternalServerError)\n\t\treturn\n\t}\n\n\tissuerURL := \"https://\" + host + \"/\" + universeID + \"/\"\n\n\tvar oidcSpec *api.OIDCSpec\n\tfor _, ep := range endpoints {\n\t\tif ep.Spec.OIDC != nil {\n\t\t\toidcSpec = ep.Spec.OIDC\n\t\t\tbreak\n\t\t}\n\t}","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/discovery/pkg/discovery/oidc.go#L20-L56","documentation":"handleOIDCDiscovery serves the /.well-known/openid-configuration document for a universe, deriving the issuer URL from the request's Host header. If the Host header is empty (r.Host == \"\"), the server cannot construct an issuer URL and rejects the request with 400 'Cannot determine host'. Per HTTP/1.1 Host is mandatory, so this indicates a malformed/proxied request.","triggerScenarios":"An HTTP client sends a request without a Host header (HTTP/1.0 client, raw socket request, or a reverse proxy that strips/rewrites the Host header before forwarding to the discovery server).","commonSituations":"Misconfigured ingress/nginx proxy that drops the Host header instead of passing it through; hand-rolled curl/telnet requests missing 'Host:'; health checks using HTTP/1.0.","solutions":["Configure your reverse proxy/ingress to preserve and forward the Host header (e.g. nginx: proxy_set_header Host $host).","Send requests with an explicit Host header, e.g. curl -H 'Host: myhost' or use HTTP/1.1.","Access the server directly by DNS name so Go's http client populates Host automatically.","Check for middleware or load balancer settings that rewrite/strip Host."],"exampleFix":"// before (proxy strips host)\nproxy_set_header Host \"\";\n// after\nproxy_set_header Host $host;","handlingStrategy":"validation","validationCode":"if req.Host == \"\" { return errors.New(\"request would lack Host header; configure proxy or set Host\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always send HTTP/1.1+ requests that include Host","Configure reverse proxies with proxy_set_header Host $host (nginx) or equivalent","Smoke-test discovery URLs through the full proxy chain"],"tags":["http","oidc","host-header","proxy"],"backgroundTag":"missing-host-header","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}