[PATCH 0/2] gweb/wispr: Normalize received HTTP header field names

[PATCH 0/2] gweb/wispr: Normalize received HTTP header field names

[Giuseppe Eletto]

This series makes connman correctly handle HTTP response headers
from modern servers that send field names in lowercase, as
permitted by RFC 9110 Section 5.1.

The first patch normalizes incoming header field names to lowercase
at parse time in gweb and updates the lookup path accordingly.
The latter updates wispr call sites to pass lowercase names,
consistent with the normalized store.

Giuseppe Eletto (2):
  gweb: Normalize received HTTP header field names to lowercase
  wispr: Use lowercase header field names in g_web_result_get_header
    calls

 gweb/gweb.c   | 19 ++++++++++++++++---
 src/wispr.c   | 12 ++++++------
 tools/wispr.c |  4 ++--
 3 files changed, 24 insertions(+), 11 deletions(-)

-- 
2.50.1

[PATCH 1/2] gweb: Normalize received HTTP header field names to lowercase

[Giuseppe Eletto]

Modern HTTP servers, including HTTP/2 and HTTP/3 backends acting
as proxies, commonly send header field names in lowercase. While
RFC 9110 Section 5.1 defines field names as case-insensitive,
connman was performing case-sensitive hash table lookups against
fixed mixed-case strings, causing lookups to silently fail when
the server used lowercase names.

Normalize incoming response header field names to lowercase at
parse time so that lookups succeed regardless of the case used
by the server.

- add_header_field: use g_ascii_strdown() instead of g_strdup()
  to normalize the key before inserting it into the hash table
- received_data_continue: look up "transfer-encoding" in lowercase
  to match the normalized store
- g_web_result_get_header: scan the caller-supplied name for
  uppercase characters and normalize with g_ascii_strdown() only
  when needed

Outgoing request headers are left in mixed case. HTTP/1.1
requires that servers recognize header field names regardless
of case, so no change is needed on the sending side.

Signed-off-by: Giuseppe Eletto <giuseppe.eletto98@gmail.com>
---
 gweb/gweb.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/gweb/gweb.c b/gweb/gweb.c
index 0a87da64..26d18544 100644
--- a/gweb/gweb.c
+++ b/gweb/gweb.c
@@ -1201,7 +1201,7 @@ static void add_header_field(struct web_session *session)
 		*pos = '\0';
 		pos++;
 
-		key = g_strdup(str);
+		key = g_ascii_strdown(str, -1);
 
 		/* remove preceding white spaces */
 		while (*pos == ' ')
@@ -1390,7 +1390,7 @@ static bool received_data_continue(struct web_session *session,
 			session->header_done = true;
 
 			val = g_hash_table_lookup(session->result.headers,
-							"Transfer-Encoding");
+							"transfer-encoding");
 			if (val) {
 				val = g_strrstr(val, "chunked");
 				if (val) {
@@ -2789,13 +2789,26 @@ bool g_web_result_get_chunk(GWebResult *result,
 bool g_web_result_get_header(GWebResult *result,
 				const char *header, const char **value)
 {
+	const char *p;
+	gchar *lower = NULL;
+
 	if (!result)
 		return false;
 
 	if (!value)
 		return false;
 
-	*value = g_hash_table_lookup(result->headers, header);
+	p = header;
+	while (*p && !g_ascii_isupper(*p))
+		p++;
+
+	if (!*p) {
+		*value = g_hash_table_lookup(result->headers, header);
+	} else {
+		lower = g_ascii_strdown(header, -1);
+		*value = g_hash_table_lookup(result->headers, lower);
+		g_free(lower);
+	}
 
 	if (!*value)
 		return false;
-- 
2.50.1

[PATCH 2/2] wispr: Use lowercase header field names in g_web_result_get_header calls

[Giuseppe Eletto]

Following the normalization of received header field names to
lowercase in gweb, update all g_web_result_get_header call sites
in src/wispr.c and tools/wispr.c to pass lowercase names.

This avoids the allocation inside g_web_result_get_header
on the common path, and keeps call sites consistent with the
normalized store.

Signed-off-by: Giuseppe Eletto <giuseppe.eletto98@gmail.com>
---
 src/wispr.c   | 12 ++++++------
 tools/wispr.c |  4 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/wispr.c b/src/wispr.c
index a40cf353..f7da6426 100644
--- a/src/wispr.c
+++ b/src/wispr.c
@@ -708,19 +708,19 @@ static void portal_manage_success_status(GWebResult *result,
 	DBG("");
 
 	/* We currently don't do anything with this info */
-	if (g_web_result_get_header(result, "X-ConnMan-Client-IP",
+	if (g_web_result_get_header(result, "x-connman-client-ip",
 				&str))
 		connman_info("Client-IP: %s", str);
 
-	if (g_web_result_get_header(result, "X-ConnMan-Client-Country",
+	if (g_web_result_get_header(result, "x-connman-client-country",
 				&str))
 		connman_info("Client-Country: %s", str);
 
-	if (g_web_result_get_header(result, "X-ConnMan-Client-Region",
+	if (g_web_result_get_header(result, "x-connman-client-region",
 				&str))
 		connman_info("Client-Region: %s", str);
 
-	if (g_web_result_get_header(result, "X-ConnMan-Client-Timezone",
+	if (g_web_result_get_header(result, "x-connman-client-timezone",
 				&str))
 		connman_info("Client-Timezone: %s", str);
 
@@ -1081,7 +1081,7 @@ static void wispr_portal_web_result_success(GWebResult *result,
 		if (wp_context->wispr_msg.message_type >= 0)
 			break;
 
-		if (g_web_result_get_header(result, "X-ConnMan-Status",
+		if (g_web_result_get_header(result, "x-connman-status",
 						&str)) {
 			portal_manage_success_status(result, wp_context);
 		} else {
@@ -1099,7 +1099,7 @@ static void wispr_portal_web_result_success(GWebResult *result,
 	case GWEB_HTTP_STATUS_CODE_TEMPORARY_REDIRECT:
 	case GWEB_HTTP_STATUS_CODE_PERMANENT_REDIRECT:
 		if (!g_web_supports_tls() ||
-			!g_web_result_get_header(result, "Location",
+			!g_web_result_get_header(result, "location",
 							&redirect)) {
 
 			wispr_portal_context_ref(wp_context);
diff --git a/tools/wispr.c b/tools/wispr.c
index 0c794ccb..810958e8 100644
--- a/tools/wispr.c
+++ b/tools/wispr.c
@@ -524,7 +524,7 @@ static bool wispr_result(const GError *error, GWebResult *result, gpointer user_
 		if (status != 302)
 			goto done;
 
-		if (!g_web_result_get_header(result, "Location", &redirect))
+		if (!g_web_result_get_header(result, "location", &redirect))
 			goto done;
 
 		printf("Redirect URL: %s\n", redirect);
@@ -583,7 +583,7 @@ static bool wispr_result(const GError *error, GWebResult *result, gpointer user_
 	if (status == 302) {
 		const char *redirect;
 
-		if (!g_web_result_get_header(result, "Location", &redirect))
+		if (!g_web_result_get_header(result, "location", &redirect))
 			goto done;
 
 		printf("\n");
-- 
2.50.1

Re: [PATCH 0/2] gweb/wispr: Normalize received HTTP header field names

[Grant Erickson]

On Jul 7, 2026, at 2:16 AM, Giuseppe Eletto <giuseppe.eletto98@gmail.com> wrote:
> 
> 
> This series makes connman correctly handle HTTP response headers
> from modern servers that send field names in lowercase, as
> permitted by RFC 9110 Section 5.1.
> 
> The first patch normalizes incoming header field names to lowercase
> at parse time in gweb and updates the lookup path accordingly.
> The latter updates wispr call sites to pass lowercase names,
> consistent with the normalized store.
> 
> Giuseppe Eletto (2):
>  gweb: Normalize received HTTP header field names to lowercase
>  wispr: Use lowercase header field names in g_web_result_get_header
>    calls
> 
> gweb/gweb.c   | 19 ++++++++++++++++---
> src/wispr.c   | 12 ++++++------
> tools/wispr.c |  4 ++--
> 3 files changed, 24 insertions(+), 11 deletions(-)
> 
> -- 
> 2.50.1

Thank you for doing this; long overdue. The approach seems reasonable to me.

Best,

Grant

-- 
Principal
Nuovations

gerickson@nuovations.com
https://www.nuovations.com/