{"id":"b8e6e4c1d436f40f","repo":"aio-libs/aiohttp","slug":"missing-host-header-in-request","errorCode":null,"errorMessage":"Missing 'Host' header in request.","messagePattern":"Missing 'Host' header in request\\.","errorType":"http","errorClass":"BadHttpMessage","httpStatus":400,"severity":"error","filePath":"aiohttp/http_parser.py","lineNumber":717,"sourceCode":"            if not url.absolute:\n                # authority-form is only allowed with CONNECT\n                # https://www.rfc-editor.org/info/rfc9112/#section-3.2.3-1\n                raise InvalidURLError(\n                    path.encode(errors=\"surrogateescape\").decode(\"latin1\")\n                )\n\n        # read headers\n        (\n            headers,\n            raw_headers,\n            close,\n            compression,\n            upgrade,\n            chunked,\n        ) = self.parse_headers(lines[1:])\n\n        if version_o == HttpVersion11 and hdrs.HOST not in headers:\n            raise BadHttpMessage(\"Missing 'Host' header in request.\")\n\n        if close is None:  # then the headers weren't set in the request\n            if version_o <= HttpVersion10:  # HTTP 1.0 must asks to not close\n                close = True\n            else:  # HTTP 1.1 must ask to close.\n                close = False\n\n        return RawRequestMessage(\n            method,\n            path,\n            version_o,\n            headers,\n            raw_headers,\n            close,\n            compression,\n            upgrade,\n            chunked,\n            url,","sourceCodeStart":699,"sourceCodeEnd":735,"githubUrl":"https://github.com/aio-libs/aiohttp/blob/c0ef574e29109210e96e652771ae4e7b88615fa4/aiohttp/http_parser.py#L699-L735","documentation":"Raised by HttpRequestParser.parse_message (aiohttp/http_parser.py:717) when an HTTP/1.1 request has no Host header. RFC 9110 section 7.2 makes Host mandatory for HTTP/1.1. HTTP/1.0 requests are not required to send Host (though encouraged), so this only fires for version 1.1.","triggerScenarios":"An HTTP/1.1 request line ('... HTTP/1.1') with no 'Host' header in the header block. Common with raw socket/netcat clients, telnet, or HTTP/1.0 clients that were bumped to 1.1 without adding Host.","commonSituations":"netcat/telnet health checks, embedded clients that build requests by hand, load-balancer probes that strip Host, or proxy misconfiguration that drops the header.","solutions":["Include a 'Host' header in every HTTP/1.1 request.","If you intend HTTP/1.0 semantics, send 'HTTP/1.0' in the request line (Host not required).","Use a real HTTP client (aiohttp.ClientSession) which sets Host automatically from the URL."],"exampleFix":"# before - HTTP/1.1 with no Host\nsock.send(b'GET / HTTP/1.1\\r\\n\\r\\n')\n# after - include Host\nsock.send(b'GET / HTTP/1.1\\r\\nHost: example.com\\r\\n\\r\\n')\n# or downgrade to HTTP/1.0 if Host is unavailable\nsock.send(b'GET / HTTP/1.0\\r\\n\\r\\n')","handlingStrategy":"validation","validationCode":"def host_ok(version: str, headers) -> bool:\n    if version == 'HTTP/1.1':\n        return any(k.lower() == 'host' for k in headers)\n    return True  # HTTP/1.0 does not require Host\nassert host_ok(version_token, outgoing_headers)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always send a Host header in HTTP/1.1 requests","Use an HTTP client that sets Host automatically","Downgrade to HTTP/1.0 only if you cannot send Host"],"tags":["http","headers","host","parser","validation","request"],"analyzedSha":"c0ef574e29109210e96e652771ae4e7b88615fa4","analyzedAt":"2026-08-04T19:51:05.467Z","schemaVersion":2}