Invalid Accept-Language header will crash the server

[indeedhat]

What version of Next.js are you using?

10.0.7

What version of Node.js are you using?

15.6.0

What browser are you using?

N/A

What operating system are you using?

Docker: node:15.6.0-alpine3.11

How are you deploying your application?

next start

Describe the Bug

If the server receives a request with an invalid Acceot-Language header it crashes due to an un caught exception

(node:18) UnhandledPromiseRejectionWarning: Error: Invalid accept-language header
    at Object.internals.parse (/app/node_modules/@hapi/accept/lib/header.js:144:28)
    at Object.exports.selections (/app/node_modules/@hapi/accept/lib/header.js:21:22)
    at Object.exports.selection (/app/node_modules/@hapi/accept/lib/header.js:12:32)
    at Object.exports.<computed> [as language] (/app/node_modules/@hapi/accept/lib/index.js:29:53)
    at DevServer.handleRequest (/app/node_modules/next/dist/next-server/server/next-server.js:19:265)
    at Server.emit (events.js:315:20)
    at parserOnIncoming (_http_server.js:790:12)
    at HTTPParser.parserOnHeadersComplete (_http_common.js:119:17)
(node:18) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag `--unhandled-rejections=strict` (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 503)

Expected Behavior

It not to crash

To Reproduce

• Start your server
• send a curl request at it with an invalid Accept-Language header \

curl https://my.next-project.com -H 'Accept-Language: ldfir;'

• the server crashes

The error will also happen with the dev server next dev but the server doesnt actually crash in that case

[hanayashiki]

same problem here

[eugle]

same problem here

[xcrzx]

I've encountered a similar crash in production (Next.js 10.2), although with a bit different stack trace:

 /usr/client/node_modules/@hapi/accept/lib/header.js:144
                 throw Boom.badRequest(`Invalid ${options.type} header`);
                            ^

 Error: Invalid accept-language header
     at Object.internals.parse (/usr/client/node_modules/@hapi/accept/lib/header.js:144:28)
     at Object.exports.selections (/usr/client/node_modules/@hapi/accept/lib/header.js:21:22)
     at Object.exports.selection (/usr/client/node_modules/@hapi/accept/lib/header.js:12:32)
     at Object.exports.<computed> [as language] (/usr/client/node_modules/@hapi/accept/lib/index.js:29:53)
     at Server.handleRequest (/usr/client/node_modules/next/dist/next-server/server/next-server.js:17:265)
     at Server.<anonymous> (/usr/client/node_modules/next/dist/server/next.js:1:1824)
     at runMicrotasks (<anonymous>)
     at processTicksAndRejections (node:internal/process/task_queues:96:5) {
   data: null,
   isBoom: true,
   isServer: false,
   output: {
     statusCode: 400,
     payload: {
       statusCode: 400,
       error: 'Bad Request',
       message: 'Invalid accept-language header'
     },
     headers: {}
   }
 }

Is there a workaround for the issue?

[eugle]

A restart event occurred with NextJS running in Docker. Docker logs are as follows:

TypeError: Cannot read property 'includes' of undefined
    at Start (/app/.next/server/pages/index.js:400:29)
    at getServerSideProps (/app/.next/server/pages/index.js:733:51)
    at renderToHTML (/app/node_modules/next/dist/next-server/server/render.js:40:221)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async /app/node_modules/next/dist/next-server/server/next-server.js:111:97
    at async /app/node_modules/next/dist/next-server/server/next-server.js:104:142
    at async Server.renderToHTMLWithComponents (/app/node_modules/next/dist/next-server/server/next-server.js:136:387)
    at async Server.renderToHTML (/app/node_modules/next/dist/next-server/server/next-server.js:137:610)
    at async Server.render (/app/node_modules/next/dist/next-server/server/next-server.js:74:255)
    at async Object.fn (/app/node_modules/next/dist/next-server/server/next-server.js:58:672)

/app/node_modules/@hapi/accept/lib/header.js:106
            throw Boom.badRequest(`Invalid ${options.type} header`);
                       ^

Error: Invalid accept-language header
    at Object.internals.parse (/app/node_modules/@hapi/accept/lib/header.js:106:24)
    at Object.exports.selections (/app/node_modules/@hapi/accept/lib/header.js:21:22)
    at Object.exports.selection (/app/node_modules/@hapi/accept/lib/header.js:12:32)
    at Object.exports.<computed> [as language] (/app/node_modules/@hapi/accept/lib/index.js:29:53)
    at Server.handleRequest (/app/node_modules/next/dist/next-server/server/next-server.js:17:265)
    at Server.<anonymous> (/app/node_modules/next/dist/server/next.js:1:1824)
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (node:internal/process/task_queues:96:5) {
  data: null,
  isBoom: true,
  isServer: false,
  output: {
    statusCode: 400,
    payload: {
      statusCode: 400,
      error: 'Bad Request',
      message: 'Invalid accept-language header'
    },
    headers: {}
  }
}
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

[lortmorris]

Hi guys, any news regarding this bug?
i have 2 sites all time down because i have request with invalid languages header.

[kkoudev]

Hi.
It's a bit brute force, but you can prevent the crash with a workaround forking @hapi/accept patched to ignore invalid headers and replacing package.json as follows:

"resolutions": {
  "@hapi/accept": "github:kkoudev/accept#ignore-invalid-headers"
}

Actually, I think it is necessary to catch the exception and handle the error inside Next.js.

[wereHamster]

I also see this exception, triggered by this code:

        const params = part.split(';');
        if (params.length > 2) {
            throw Boom.badRequest(`Invalid ${options.type} header`);
        }

It's a shame that the error message doesn't include the actual value of the header, would help me debug what's causing it. I suspect a broken browser which sends an invalid Accept-Language header…

[psaren]

I find if we set i18n.localeDetection = false, ignore accept.language method, this error will not show again.
But I am not sure, whether it will cause other problem,

next.js/packages/next/next-server/server/next-server.ts

Lines 430 to 433 in 3b76d33

	let acceptPreferredLocale =
	i18n.localeDetection !== false
	? accept.language(req.headers['accept-language'], i18n.locales)
	: detectedLocale

[indeedhat]

I also see this exception, triggered by this code:

        const params = part.split(';');
        if (params.length > 2) {
            throw Boom.badRequest(`Invalid ${options.type} header`);
        }

It's a shame that the error message doesn't include the actual value of the header, would help me debug what's causing it. I suspect a broken browser which sends an invalid Accept-Language header…

Based on the regularity that it was happening and that i multiple pods would tend to crash at the same time it was my assumption that it was some kind of bot that was causing it.

But i totally agree that it would be nice the get the actual content logged.

I find if we set i18n.localeDetection = false, ignore accept.language method, this error will not show again.
But I am not sure, whether it will cause other problem,

next.js/packages/next/next-server/server/next-server.ts

Lines 430 to 433 in 3b76d33

	let acceptPreferredLocale =
	i18n.localeDetection !== false
	? accept.language(req.headers['accept-language'], i18n.locales)
	: detectedLocale

This is the stop gap i have ended up with until there is a proper fix, its not ideal but its better than getting repeated crashes and it at least allows for manual language selection.