reverseproxy: Fix check for `header_up Host {upstream_hostport}` redundancy (#7564)

* Fix check for header_up Signed-off-by: yubiuser <github@yubiuser.dev> * Onyl check in case commonScheme == "https" Signed-off-by: yubiuser <github@yubiuser.dev> * Move check after TLS transport is enabled Signed-off-by: yubiuser <github@yubiuser.dev> --------- Signed-off-by: yubiuser <github@yubiuser.dev>

yubiuser committed Mar 30, 2026 at 18:56 UTC ea4ee3ae5d5f0e0548e3e90683ba321c02d94afc

1 file changed +8 -3

modules/caddyhttp/reverseproxy/caddyfile.go

+8 -3

@@ -725,9 +725,6 @@ func (h *Handler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {

725 err = headers.CaddyfileHeaderOp(h.Headers.Request, args[0], "", nil)

726 case 2:

727 // some lint checks, I guess

728 - if strings.EqualFold(args[0], "host") && (args[1] == "{hostport}" || args[1] == "{http.request.hostport}") {

729 - caddy.Log().Named("caddyfile").Warn("Unnecessary header_up Host: the reverse proxy's default behavior is to pass headers to the upstream")

730 - }

728 if strings.EqualFold(args[0], "x-forwarded-for") && (args[1] == "{remote}" || args[1] == "{http.request.remote}" || args[1] == "{remote_host}" || args[1] == "{http.request.remote.host}") {

729 caddy.Log().Named("caddyfile").Warn("Unnecessary header_up X-Forwarded-For: the reverse proxy's default behavior is to pass headers to the upstream")

730 }

@@ -885,6 +882,14 @@ func (h *Handler) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {

882 return err

883 }

884 }

885 + // check if the user set 'header_up host upstream_hostport' when proxying to HTTPS

886 + // this is unnecessary because it's the default behavior already

887 + if te.TLSEnabled() && h.Headers != nil && h.Headers.Request != nil {

888 + hostVal := h.Headers.Request.Set.Get("Host")

889 + if hostVal == "{upstream_hostport}" || hostVal == "{http.reverse_proxy.upstream.hostport}" {

890 + caddy.Log().Named("caddyfile").Warn("Unnecessary header_up Host: the reverse proxy's default behavior is to pass the configured upstream address to the upstream when proxying to HTTPS")

891 + }

892 + }

893 if commonScheme == "http" && te.TLSEnabled() {

894 return d.Errf("upstream address scheme is HTTP but transport is configured for HTTP+TLS (HTTPS)")

895 }