[9.1] Inject host information in the request to prevent HTTP2 IPv6 failures (#242241) (#242565)

# Backport

This will backport the following commits from `main` to `9.1`:
- [Inject host information in the request to prevent HTTP2 IPv6 failures
(#242241)](#242241)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Gerard
Soldevila","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-11-11T15:27:16Z","message":"Inject
host information in the request to prevent HTTP2 IPv6 failures
(#242241)\n\n## Summary\n\nWorkarounds
https://github.com/elastic/kibana/issues/236380\n\nThe official way to
address this is with the following issue + PR on\nhapijs/hapi side:\n*
https://github.com/hapijs/hapi/issues/4560\n*
https://github.com/hapijs/hapi/pull/4559\n\nUntil then, we can inject
the Host information that Hapi relies on when\nit builds the `url`
string.","sha":"0d41ec283b40c2d9229c1e22d4f8dfd7c62f4747","branchLabelMapping":{"^v9.3.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","Team:Core","release_note:skip","backport:version","v9.3.0","v9.1.7","v9.2.1"],"title":"Inject
host information in the request to prevent HTTP2 IPv6
failures","number":242241,"url":"https://github.com/elastic/kibana/pull/242241","mergeCommit":{"message":"Inject
host information in the request to prevent HTTP2 IPv6 failures
(#242241)\n\n## Summary\n\nWorkarounds
https://github.com/elastic/kibana/issues/236380\n\nThe official way to
address this is with the following issue + PR on\nhapijs/hapi side:\n*
https://github.com/hapijs/hapi/issues/4560\n*
https://github.com/hapijs/hapi/pull/4559\n\nUntil then, we can inject
the Host information that Hapi relies on when\nit builds the `url`
string.","sha":"0d41ec283b40c2d9229c1e22d4f8dfd7c62f4747"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","9.2"],"targetPullRequestStates":[{"branch":"main","label":"v9.3.0","branchLabelMappingKey":"^v9.3.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/242241","number":242241,"mergeCommit":{"message":"Inject
host information in the request to prevent HTTP2 IPv6 failures
(#242241)\n\n## Summary\n\nWorkarounds
https://github.com/elastic/kibana/issues/236380\n\nThe official way to
address this is with the following issue + PR on\nhapijs/hapi side:\n*
https://github.com/hapijs/hapi/issues/4560\n*
https://github.com/hapijs/hapi/pull/4559\n\nUntil then, we can inject
the Host information that Hapi relies on when\nit builds the `url`
string.","sha":"0d41ec283b40c2d9229c1e22d4f8dfd7c62f4747"}},{"branch":"9.1","label":"v9.1.7","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.2","label":"v9.2.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Gerard Soldevila <[email protected]>

Author: kibanamachine

src/core/packages/http/router-server-internal/src/request.ts

@@ -173,6 +173,7 @@ export class CoreKibanaRequest<
     this.uuid = appState?.requestUuid ?? uuidv4();
     this.rewrittenUrl = appState?.rewrittenUrl;
     this.authzResult = appState?.authzResult;
+    this.injectHostInfo(request);
 
     this.url = request.url ?? new URL('https://fake-request/url');
     this.headers = isRealReq ? deepFreeze({ ...request.headers }) : request.headers;
@@ -208,6 +209,32 @@ export class CoreKibanaRequest<
     };
   }
 
+  /**
+   * Hapi does not officially support HTTP2 at the moment.
+   * - On HTTP/2 the 'Host:' header is replaced by ':authority:'.
+   * - Thus, for HTTP/2 requests, Hapi's request.url getter defaults to using
+   *   the server host information to build the full URL.
+   * - If we configure Kibana to use a "bare" IPv6 host (without square brackets),
+   *   this causes Hapi's request.url getter to try to build ambiguous invalid URLs.
+   *
+   * Note that an IPv6 address like 2001:db8::1:8080 would be ambiguous,
+   * as 8080 could be interpreted as the last segment of the IP address rather than the port.
+   *
+   * This method alters the original Hapi Request object,
+   * injecting the missing 'Host:' header if the ':authority:' information is present (i.e. HTTP/2 request).
+   * This way, the URL is no longer built using server host information,
+   * which causes https://github.com/elastic/kibana/issues/236380 when using IPv6 server.host
+   *
+   * TODO remove this when https://github.com/hapijs/hapi/issues/4560 is addressed
+   * @param request the request to 'decorate'
+   */
+  injectHostInfo(request: RawRequest) {
+    const r = request as RawRequest & { info: Record<string, any> };
+    if (typeof r.info === 'object' && !r.info.host && r.headers[':authority']) {
+      r.info.host = r.headers[':authority'];
+    }
+  }
+
   toString() {
     return `[CoreKibanaRequest id="${this.id}" method="${this.route.method}" url="${this.url}" fake="${this.isFakeRequest}" system="${this.isSystemRequest}" api="${this.isInternalApiRequest}"]`;
   }