#2375 #2376 Map non-ASCII header HttpRequestException to 400 Bad Request

src/Ocelot/Errors/OcelotErrorCode.cs

@@ -44,4 +44,5 @@ public enum OcelotErrorCode
     CouldNotFindLoadBalancerCreator = 39,
     ErrorInvokingLoadBalancerCreator = 40,
     PayloadTooLargeError = 41,
+    BadRequestError = 42,
 }

src/Ocelot/Middleware/OcelotPipelineExtensions.cs

@@ -24,7 +24,10 @@ namespace Ocelot.Middleware;
 
 public static class OcelotPipelineExtensions
 {
-    public static RequestDelegate BuildOcelotPipeline(this IApplicationBuilder app, OcelotPipelineConfiguration configuration)
+    public static RequestDelegate BuildOcelotPipeline(
+        this IApplicationBuilder app,
+        OcelotPipelineConfiguration configuration
+    )
     {
         // this sets up the downstream context and gets the config
         app.UseMiddleware<ConfigurationMiddleware>();
@@ -34,7 +37,8 @@ public static RequestDelegate BuildOcelotPipeline(this IApplicationBuilder app,
         app.UseMiddleware<ExceptionHandlerMiddleware>();
 
         // If the request is for websockets upgrade we fork into a different pipeline
-        app.MapWhen(httpContext => httpContext.WebSockets.IsWebSocketRequest,
+        app.MapWhen(
+            httpContext => httpContext.WebSockets.IsWebSocketRequest,
             ws =>
             {
                 ws.UseMiddleware<DownstreamRouteFinderMiddleware>();
@@ -43,7 +47,8 @@ public static RequestDelegate BuildOcelotPipeline(this IApplicationBuilder app,
                 ws.UseMiddleware<LoadBalancingMiddleware>();
                 ws.UseMiddleware<DownstreamUrlCreatorMiddleware>();
                 ws.UseMiddleware<WebSocketsProxyMiddleware>();
-            });
+            }
+        );
 
         // Allow the user to respond with absolutely anything they want.
         app.UseIfNotNull(configuration.PreErrorResponderMiddleware);
@@ -128,11 +133,15 @@ public static RequestDelegate BuildOcelotPipeline(this IApplicationBuilder app,
         return app.Build();
     }
 
-    private static IApplicationBuilder UseIfNotNull(this IApplicationBuilder builder, Func<HttpContext, Func<Task>, Task> middleware)
-        => middleware != null ? builder.Use(middleware) : builder;
-
-    private static IApplicationBuilder UseIfNotNull<TMiddleware>(this IApplicationBuilder builder, Func<HttpContext, Func<Task>, Task> middleware)
-        where TMiddleware : OcelotMiddleware => middleware != null
-            ? builder.Use(middleware)
-            : builder.UseMiddleware<TMiddleware>();
+    private static IApplicationBuilder UseIfNotNull(
+        this IApplicationBuilder builder,
+        Func<HttpContext, Func<Task>, Task> middleware
+    ) => middleware != null ? builder.Use(middleware) : builder;
+
+    private static IApplicationBuilder UseIfNotNull<TMiddleware>(
+        this IApplicationBuilder builder,
+        Func<HttpContext, Func<Task>, Task> middleware
+    )
+        where TMiddleware : OcelotMiddleware =>
+        middleware != null ? builder.Use(middleware) : builder.UseMiddleware<TMiddleware>();
 }

src/Ocelot/Requester/BadRequestError.cs

@@ -0,0 +1,12 @@
+using System;
+using Ocelot.Errors;
+
+namespace Ocelot.Requester;
+
+public class BadRequestError : Error
+{
+    public BadRequestError(string message) 
+        : base(message, OcelotErrorCode.BadRequestError, 400)
+    {
+    }
+}

src/Ocelot/Requester/HttpExceptionToErrorMapper.cs

@@ -47,6 +47,14 @@ public Error Map(Exception exception)
                 return new PayloadTooLargeError(exception);
             }
 
+            // Late Catch: Map the HttpRequestException to a 400 Bad Request.
+            // If the header format is invalid, HttpClient throws this exception locally.
+            // By catching it here, we ensure Ocelot returns a clean 4xx client error instead of a generic 502 Bad Gateway.
+            if (exception is HttpRequestException && exception.Message.Contains("only ASCII characters"))
+            {
+                return new BadRequestError(exception.Message);
+            }
+
             return new ConnectionToDownstreamServiceError(exception);
         }
 

src/Ocelot/Responder/ErrorsToHttpStatusCodeMapper.cs

@@ -61,6 +61,11 @@ public int Map(List<Error> errors)
             return 413;
         }
 
+        if (errors.Any(e => e.Code == OcelotErrorCode.BadRequestError))
+        {
+            return 400;
+        }
+
         return 404;
     }
 }