[pfefferle]

Fixes #

Proposed changes:

• The RFC 9421 verifier now reads an allowed X-Original-Host first for @authority, @target-uri and the host field, the same way the Draft Cavage verifier already does. Before, sites behind a proxy that rewrites Host could not verify RFC 9421 signatures.
• A foreign X-Original-Host is ignored, then Host has to name this site, as before (Only verify signatures made out to this site #3964).

Other information:

• Have you written new tests for your changes, if applicable?

@target-uri still takes the scheme from is_ssl(). Behind a proxy that terminates TLS, WordPress has to know about HTTPS (for example via X-Forwarded-Proto or $_SERVER['HTTPS']), otherwise the scheme does not match. That is WordPress configuration, not part of this change.

Testing instructions:

• vendor/bin/phpunit --filter 'rfc9421_accepts_our_own_original_host|rfc9421_rejects_a_foreign_original_host'
• The first test signs for this site, sends the request as internal.local with X-Original-Host set to this site, and expects it to verify. Without the change it fails.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message