Normalize Host header

crates/wasip3/src/http_compat/conversions.rs

@@ -101,14 +101,39 @@ where
         }
     }
 
-    let (parts, body) = req.into_parts();
+    let (mut parts, body) = req.into_parts();
 
     let options = parts
         .extensions
         .get::<RequestOptionsExtension>()
         .cloned()
         .map(|o| o.0);
 
+    // `wasmtime-wasi-http` forbids the `Host` header on requests, instead
+    // carrying the authority via `set-authority` (the `:authority`
+    // pseudo-header). Normalize any `Host` header into the request authority so
+    // that requests built with a `Host` header (such as middleware forwarding
+    // an incoming request) remain compatible. See RFC 9110 §7.2, RFC 9113
+    // §8.3.1.
+    let host = parts
+        .headers
+        .remove(http::header::HOST)
+        .map(|value| value.to_str().map(str::to_owned))
+        .transpose()
+        .map_err(to_internal_error_code)?;
+
+    let authority = match (parts.uri.authority(), host) {
+        // If both are present they must be identical, otherwise the request is
+        // malformed.
+        (Some(authority), Some(host)) if authority != host.as_str() => {
+            return Err(to_internal_error_code(
+                "Host header does not match URI authority",
+            ));
+        }
+        (Some(authority), _) => Some(authority.as_str().to_owned()),
+        (None, host) => host,
+    };
+
     let headers = parts.headers.try_into().map_err(to_internal_error_code)?;
 
     let (body_writer, contents_rx, trailers_rx) = BodyWriter::new();
@@ -122,7 +147,7 @@ where
     req.set_scheme(scheme.as_ref())
         .map_err(|()| ErrorCode::HttpProtocolError)?;
 
-    req.set_authority(parts.uri.authority().map(|a| a.as_str()))
+    req.set_authority(authority.as_deref())
         .map_err(|()| ErrorCode::HttpRequestUriInvalid)?;
 
     req.set_path_with_query(parts.uri.path_and_query().map(|pq| pq.as_str()))