client-proxy: WARN "invalid host" spam from unroutable bare-IP Host requests (external probes)

Open Beginner friendly
  • Is something wrong?
#3,783 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

@AdaAibaby is already working on this.

Since Nov 2, 2026.

  • #3784 by @AdaAibaby — open
  • #3785 by @AdaAibaby — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
backend

Research direction

The change belongs in the ErrInvalidHost branch of handler() in packages/shared/pkg/proxy/handler.go, which uses isLocalRequestHost from host.go and a routing-header check. Read those helpers first, then add a unit test for a bare-IP Host with no E2b-Sandbox-Id/E2b-Sandbox-Port headers. Done means that case logs at Debug, a malformed domain host still logs at Warn, and the 400 response is unchanged. Confirm the direction with a maintainer before opening the PR.

Written by the indexing model from the issue text.

Description

Summary

client-proxy logs WARN "invalid host" for every inbound request whose Host is a bare IP address with no sandbox routing headers. On any proxy with a public endpoint these arrive continuously from external scanners, health probes, and stale clients still pointed at an old node IP, producing ~1 line/second of WARN noise that drowns real warnings.

Observed (client-proxy):

WARN  invalid host  {"service":"client-proxy","host":"118.196.30.209"}
WARN  invalid host  {"service":"client-proxy","host":"118.196.30.209"}
... (repeats every ~1s)
Why these are expected, not warnings

packages/shared/pkg/proxy/handler.go rejects the request with ErrInvalidHost and returns 400, which is correct. But a bare-IP Host cannot encode sandbox routing ({port}-{sandboxID}.{domain}) — as isLocalRequestHost in host.go documents, header-based routing is the only mechanism that can work for an IP host. So an IP Host that also carries no routing headers (E2b-Sandbox-Id / E2b-Sandbox-Port) is, by construction, unroutable. Rejecting it is the designed behavior; logging it at WARN on every hit just turns routine external traffic into log spam.

(Header-based routing for IP hosts — #2581 — is unaffected: an IP host with routing headers routes fine and never reaches this branch.)

Proposal

In the ErrInvalidHost branch of handler(), log at Debug when the host is a raw IP / localhost and no routing headers are present (isLocalRequestHost(r.Host) && !hasRoutingHeaders(r.Header)), and keep Warn for a genuinely suspect invalid host (a malformed domain host), which is rare and worth visibility. Status code stays 400 in both cases — this only changes log level, not behavior.

Environment

Reproduced on client-proxy main; the proxy sits behind a public ingress, so any internet host hitting the raw IP triggers it. Same code path in api (OpenAPI validator logs the same raw-IP / requests as 404 no matching operation), but the client-proxy WARN is the loudest.

Happy to send the PR (small, with a unit test) if the direction is acceptable.

Dominant language
Go
Stars
1.8k
Forks
503
No merged PRs in 30d

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from e2b-dev/runtime

All issues in e2b-dev/runtime

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.