TrustedHostMiddleware Doesn't handle IPv6 properly

[gopackgo90]

Say I have the below Starlette app,

# main.py
from starlette.applications import Starlette
from starlette.middleware import Middleware
from starlette.middleware.trustedhost import TrustedHostMiddleware
from starlette.responses import JSONResponse
from starlette.routing import Route


async def homepage(request):
    return JSONResponse({'hello': 'world'})

routes = [
    Route("/", endpoint=homepage)
]

middleware = [
    Middleware(TrustedHostMiddleware, allowed_hosts=["[::1]"])
]

app = Starlette(debug=True, routes=routes, middleware=middleware)

and run it with uvicorn main:app --host '::1'. When I go to http://[::1]:8000 in my browser, I get the "Invalid host header" response. This appears to be because Starlette is thinking the host is "[" based on the splitting logic in the middleware,

starlette/starlette/middleware/trustedhost.py

Line 40 in 70a3bd4

host = headers.get("host", "").split(":")[0]

.
When I remove the TrustedHostMiddleware, I get the hello world response as expected.

[apoorva-01]

Confirmed, this is a real bug and your diagnosis is spot on. The middleware does headers.get("host", "").split(":")[0], which assumes at most one colon. An IPv6 Host header is [::1]:8000, so splitting on the first colon hands back [, which never equals [::1], hence the 400.

There's no config flag around it since that parsing is hardcoded. Cleanest stopgap is a subclass that fixes the Host header to its bracket-only form before the parent's check runs:

from starlette.datastructures import Headers
from starlette.middleware.trustedhost import TrustedHostMiddleware


class IPv6SafeTrustedHost(TrustedHostMiddleware):
    async def __call__(self, scope, receive, send):
        if scope["type"] in ("http", "websocket") and not self.allow_any:
            raw = Headers(scope=scope).get("host", "")
            fixed = raw[: raw.index("]") + 1] if raw.startswith("[") else raw.split(":")[0]
            scope = {
                **scope,
                "headers": [
                    (k, fixed.encode() if k == b"host" else v) for k, v in scope["headers"]
                ],
            }
        await super().__call__(scope, receive, send)

Then allowed_hosts=["[::1]"] matches. One caveat: this rewrites the Host header to drop the port for the downstream app, which is almost never a problem but worth knowing.

Worth opening a PR too if there isn't one, the real fix is just teaching that split(":") line about brackets.

[gopackgo90]

I opened PR #3358