fix(client): strip IPv6 link-local zone id from Host header

[zhaoxinyi02]

Problem

When a request is made to a URL containing an IPv6 link-local address with a zone id (e.g. http://[fe80::1%eth0]/), aiohttp sends the zone id verbatim as part of the Host header: Host: [fe80::1%eth0].

Per RFC 6874 §4, the zone id only has local significance to the sending host and must be removed by the client:

an HTTP client, proxy, or other intermediary MUST remove any ZoneID attached to an outgoing URI, as it has only local significance at the sending host.

Servers that validate the Host header strictly against RFC 3986 — for example nginx from 1.29.4 onward — now reject such requests with 400 Bad Request.

Root cause

_update_headers builds the Host header from self.url.host_port_subcomponent, which yarl returns including the zone id. The same applies to the CONNECT authority form URI built in _send.

Fix

Strip the zone id before building the Host header in _update_headers, and before building the CONNECT authority form URI in _send. Both use url.with_host(raw_host.split("%", 1)[0]) when the raw host contains %.

raw_host is used (rather than host) so the check operates on the un-decoded form, matching yarl's own IPv6 handling.

Testing

Added two regression tests to tests/test_client_request.py:

• test_host_header_ipv6_link_local_zone_id_stripped — verifies Host: [fe80::1] (zone id removed, no port)
• test_host_header_ipv6_link_local_zone_id_with_port — verifies Host: [fe80::1]:99 (zone id removed, port preserved)

Existing tests for plain IPv6, IPv4, domains, and explicit Host headers continue to pass, confirming the fix only affects the zone-id case.

Fixes aio-libs/yarl#1862

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[codecov]

Codecov Report

❌ Patch coverage is 87.50000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 98.99%. Comparing base (d041d4d) to head (3d3d9e5).
⚠️ Report is 3 commits behind head on master.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
aiohttp/client_reqrep.py	80.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   aio-libs/aiohttp#13409      +/-   ##
==========================================
- Coverage   98.99%   98.99%   -0.01%     
==========================================
  Files         132      132              
  Lines       49454    49468      +14     
  Branches     2572     2574       +2     
==========================================
+ Hits        48959    48971      +12     
- Misses        371      372       +1     
- Partials      124      125       +1     

Flag	Coverage Δ
Autobahn	22.08% <31.25%> (+<0.01%)	⬆️
CI-GHA	98.90% <87.50%> (-0.01%)	⬇️
OS-Linux	98.68% <87.50%> (-0.01%)	⬇️
OS-Windows	97.03% <87.50%> (-0.01%)	⬇️
OS-macOS	97.93% <87.50%> (+<0.01%)	⬆️
Py-3.10	98.13% <87.50%> (-0.01%)	⬇️
Py-3.11	98.38% <87.50%> (-0.01%)	⬇️
Py-3.12	98.47% <87.50%> (-0.01%)	⬇️
Py-3.13	98.45% <87.50%> (-0.02%)	⬇️
Py-3.14	98.47% <87.50%> (-0.01%)	⬇️
Py-3.14t	97.55% <87.50%> (-0.01%)	⬇️
Py-pypy-3.11	97.42% <87.50%> (-0.01%)	⬇️
VM-macos	97.93% <87.50%> (+<0.01%)	⬆️
VM-ubuntu	98.68% <87.50%> (-0.01%)	⬇️
VM-windows	97.03% <87.50%> (-0.01%)	⬇️
cython-coverage	38.14% <18.75%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security failures identified.

The temporary URL rewrite removes the locally significant zone identifier only from transmitted authority values, preserves port handling, and leaves the original scoped URL intact for connection routing.

_{Reviews (1): Last reviewed commit: "fix(client): strip IPv6 link-local zone ..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will improve performance by 9.26%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 83 untouched benchmarks
⏩ 83 skipped benchmarks¹

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	test_simple_web_file_response[ssl-large]	307.7 ms	281.6 ms	+9.26%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing zhaoxinyi02:fix/13401-strip-ipv6-zone-id (3d3d9e5) with master (d041d4d)²}

Footnotes

1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on master (77c5108) during the generation of this report, so d041d4d was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩