Skip to content

fix: Omit default port from Host header in MqttServerWs2Connection#643

Merged
shamblett merged 1 commit into
shamblett:masterfrom
fujimonfn:fix/omit-default-port-from-host-header
Mar 25, 2026
Merged

fix: Omit default port from Host header in MqttServerWs2Connection#643
shamblett merged 1 commit into
shamblett:masterfrom
fujimonfn:fix/omit-default-port-from-host-header

Conversation

@fujimonfn

Copy link
Copy Markdown
Contributor

Summary

The _performWSHandshake method in MqttServerWs2Connection always includes the port number in the Host header, even when using the default port for the scheme (443 for wss://, 80 for ws://).

Per RFC 7230 Section 5.4:

If the target URI includes an authority component, then a client MUST send a field-value for Host that is identical to that authority component, excluding any userinfo subcomponent and its "@" delimiter.

And RFC 3986 Section 3.2.3:

URI producers and normalizers should omit the port component and its ":" delimiter if port is empty or if its value would be the same as that of the scheme's default.

Current behavior: Host: endpoint:443 (always includes port)
Expected behavior: Host: endpoint (omit default port)

Problem

AWS IoT Core (and potentially other WebSocket servers that perform SigV4 or similar Host-header-based authentication) rejects WebSocket upgrade requests with Host: endpoint:443, returning 403 Forbidden. This is because the server normalizes the Host header by stripping the default port, causing a mismatch with the signed request.

The standard MqttServerWsConnection does not have this issue because Dart's WebSocket.connect() / HttpClient correctly omits the default port from the Host header.

Fix

Only include the port in the Host header when it differs from the scheme's default port:

  • wss:// → default port 443
  • ws:// → default port 80

Only include the port in the Host header when it differs from the
scheme's default port (443 for wss, 80 for ws). This fixes 403
Forbidden errors from AWS IoT Core and other servers that normalize
the Host header by stripping default ports.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@shamblett shamblett merged commit 00eda62 into shamblett:master Mar 25, 2026
1 of 2 checks passed
@shamblett

Copy link
Copy Markdown
Owner

Merged, package re published at version 10.11.10.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants