Fixed #181 -- Improved Host validation for malformed colon values.

[DevilsAutumn]

Summary

Host header validation now rejects malformed authority values before auth or handlers run. Bad ports such as localhost:bad and bare IPv6 values such as ::1 now return 400 Invalid Host header, even when allowed_hosts=["*"]; valid bracketed IPv6 hosts such as [::1] and [::1]:8000 still work.

Linked Issue

Fixes #181

Contributor Checklist

• The linked issue was marked accepted before I started.
• Nobody else was assigned or already working on the issue before I started.
• My branch is named issue_{issue_number}.
• The PR is focused on one issue with no unrelated changes.
• Tests are added or updated when behavior changes.
• Docs are updated when user-facing behavior changes.
• Changelog is updated when the change is release-visible.
• I listed the checks I ran below.

Checks Run

[greptile-apps]

Greptile Summary

This PR tightens Host header validation for malformed authority values. The main changes are:

• Rejects malformed ports and unbracketed IPv6 request authorities before auth or handlers run.
• Preserves valid bracketed IPv6 hosts like [::1] and [::1]:8000.
• Adds unit and cross-transport tests for ASGI, WSGI, and RSGI behavior.
• Updates the changelog for the release-visible validation change.

Confidence Score: 5/5

Safe to merge with minimal risk.

The change is localized to host normalization and header validation. The accepted bracketed IPv6 path and configured bare IPv6 allow-list patterns remain covered. Tests cover malformed ports, bare IPv6, wildcard host settings, and transport consistency.

No files require special attention.

T-Rex Logs

What T-Rex did

• Ran a focused pytest test suite for host-header validation and confirmed the run completed with 69 tests passing.
• Validated the after-change host-header validation harness results show invalid hosts return 400 with 'Invalid Host header' and the local/IPv6 reach returns 200 with a normal payload.
• Compared the before-change harness state to confirm the contract change: the pre-change harness returned 200 OK on all four hosts and invoked auth/handler for all of them.
• The comparison shows a change in endpoint/service-contract behavior between before and after, aligning with the intended contract update.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
src/quater/security.py	Updates host normalization to reject malformed ports and bare IPv6 request authorities before allowed-host matching, while preserving configured bare IPv6 allow-list support.
tests/unit/test_allowed_hosts.py	Adds unit coverage for malformed unbracketed hosts, bracketed IPv6 ports, bare IPv6 authorities, wildcard behavior, and malformed allowed-host patterns.
tests/integration/test_cross_transport_behavior.py	Adds cross-transport assertions that malformed Host syntax is rejected consistently across ASGI, WSGI, and RSGI before handlers run.
docs/en/dev/changelog.md	Documents the host validation fix and examples of rejected malformed authorities and accepted bracketed IPv6 forms.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant C as Client
participant Ad as ASGI/WSGI/RSGI Adapter
participant Sec as security.py
participant Auth as Auth
participant H as Handler

C->>Ad: Request with Host / :authority
Ad->>Sec: prepare_request_security(request, config)
Sec->>Sec: _validate_singleton_request_headers()
Sec->>Sec: _normalize_host(host / authority)
alt malformed authority or disallowed host
    Sec-->>Ad: 400 Invalid Host header
else valid normalized host
    Sec->>Sec: _validate_allowed_host()
    Sec->>Auth: continue to authentication
    Auth->>H: invoke route handler
    H-->>Ad: response
end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant C as Client
participant Ad as ASGI/WSGI/RSGI Adapter
participant Sec as security.py
participant Auth as Auth
participant H as Handler

C->>Ad: Request with Host / :authority
Ad->>Sec: prepare_request_security(request, config)
Sec->>Sec: _validate_singleton_request_headers()
Sec->>Sec: _normalize_host(host / authority)
alt malformed authority or disallowed host
    Sec-->>Ad: 400 Invalid Host header
else valid normalized host
    Sec->>Sec: _validate_allowed_host()
    Sec->>Auth: continue to authentication
    Auth->>H: invoke route handler
    H-->>Ad: response
end

Loading

_{Reviews (2): Last reviewed commit: "Fixed #181 -- Improved Host validation f..." | Re-trigger Greptile}

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.82%. Comparing base (e359a8a) to head (34ec5d9).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #182      +/-   ##
==========================================
+ Coverage   92.63%   92.82%   +0.18%     
==========================================
  Files          66       66              
  Lines        6546     6565      +19     
  Branches     1113     1116       +3     
==========================================
+ Hits         6064     6094      +30     
+ Misses        291      286       -5     
+ Partials      191      185       -6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.