Health check endpoint returns 400 for HTTP/1.0 requests without Host header
## Description
The `/health` endpoint returns HTTP 400 Bad Request when accessed by load balancer health checks that use HTTP/1.0 without a `Host` header.
## Environment
- Image: `zulip/docker-zulip:9.3-0`
- Configuration: `DISABLE_HTTPS: "True"` with `LOADBALANCER_IPS` configured
## Steps to Reproduce
1. Configure Zulip behind a load balancer with TLS termination
2. Configure LB health check to probe `/health` endpoint
3. LB sends HTTP/1.0 request without Host header (common for many cloud LB health probes)
## Observed Behavior
```
10.0.0.3 - - [22/Jan/2026:17:02:08 +0000] "GET /health HTTP/1.0" 400 143 "-" "-" 0.002
```
The request returns 400 Bad Request.
## Expected Behavior
The `/health` endpoint should return 200 OK for health check requests, even without a `Host` header, since:
1. Many cloud load balancers (AWS ALB/NLB, GCP, Azure LB) use HTTP/1.0 for health probes
2. HTTP/1.0 does not require a Host header
3. The `/health` endpoint is specifically designed for load balancer health checks
## Workaround
Configure the load balancer to send a `Host` header with the health check request.
## Suggested Fix
Add a `server` block in nginx that handles requests without a `Host` header for the `/health` endpoint, similar to:
```nginx
server {
listen 80 default_server;
server_name "";
location = /health {
proxy_pass http://127.0.0.1:9993/api/v1/server_settings;
# or return the health check response directly
}
location / {
return 400;
}
}
```
Or configure the existing health check location to work in the default server block.
0 条评论