Skip to content

net/http: StripPrefix does not always strip in a valid way #78470

@zepatrik

Description

@zepatrik

Go version

go version go1.26.0 darwin/arm64

Output of go env in your module/workspace:

stdlib implementation bug, unrelated to env

What did you do?

Simply using the http.StripPrefix helper to strip a known prefix.

What did you see happen?

  1. When the request path is exactly the prefix, the req.URL.Path is set to the empty string instead of /. This can break downstream handlers, as they can reasonably expect the path to not be empty per RFC 7230 §5.3.1
    See also net/http: ServeFile panics when StripPrefix over-strips and results in empty path #30165, which is basically running into this as well.
  2. When the prefix is URL encoded, this incorrectly results in a 404 response because the RawPath cannot be simply stripped with strings.TrimPrefix. Example: prefix = "/prefix", request path = "/pr%65fix/somepath", expected handler path = "/somepath", actual response = "404 page not found"

What did you expect to see?

For problem 1, I'd expect / as the path.

For Problem 2, I'd expect the prefix to be correctly stripped from the RawPath as well as the Path. There should not be a 404 response in case the requested path contains escape sequences in the prefix part.
I'd also expect the semantics of RawPath to be preserved, i.e. it should only be set if Path cannot be unambiguously encoded. Therefore, a request which has any encoded characters only in the prefix part, should not have RawPath set after it was handled by http.StripPrefix.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions