RitiGrover · Oct 14, 2026 · Oct 14, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,9 @@
 
 ## Unreleased: mitmproxy next
 
+- Wrap IPv6 hosts in square brackets when building `Host` headers and URLs. This fixes the
+  `Host` header that reverse proxy mode sent to IPv6 backends, and `request.url` for IPv6 targets.
+  ([#8484](https://github.com/mitmproxy/mitmproxy/pull/8484), @RitiGrover)
 - Fix the global `listen_port` option being applied to proxy modes that don't
   bind a port (e.g. `local`), which caused a "Cannot spawn multiple servers on
   the same address" error when enabling local capture.

diff --git a/mitmproxy/net/http/url.py b/mitmproxy/net/http/url.py
@@ -144,6 +144,12 @@ def hostport(scheme: AnyStr, host: AnyStr, port: int) -> AnyStr:
     """
     Returns the host component, with a port specification if needed.
     """
+    # IPv6 literals need brackets to tell their colons apart from the port.
+    if isinstance(host, bytes) and b":" in host and not host.startswith(b"["):
+        host = b"[%s]" % host
+    elif isinstance(host, str) and ":" in host and not host.startswith("["):
+        host = f"[{host}]"
+
     if default_port(scheme) == port:
         return host
     else:

diff --git a/test/mitmproxy/net/http/test_url.py b/test/mitmproxy/net/http/test_url.py
@@ -166,6 +166,22 @@ def test_hostport():
     assert url.hostport(b"https", b"foo.com", 8080) == b"foo.com:8080"
 
 
+def test_hostport_ipv6():
+    assert url.hostport("http", "::1", 8080) == "[::1]:8080"
+    assert url.hostport("http", "::1", 80) == "[::1]"
+    assert url.hostport(b"https", b"2001:db8::1", 8443) == b"[2001:db8::1]:8443"
+    assert url.hostport(b"https", b"2001:db8::1", 443) == b"[2001:db8::1]"
+    assert url.hostport("http", "[::1]", 8080) == "[::1]:8080"
+
+
+def test_unparse_ipv6():
+    assert url.unparse("http", "::1", 8080, "/a") == "http://[::1]:8080/a"
+    assert (
+        url.unparse(b"https", b"2001:db8::1", 443, b"/a") == b"https://[2001:db8::1]/a"
+    )
+    assert url.unparse(*url.parse("http://[::1]:8080/a")) == b"http://[::1]:8080/a"
+
+
 def test_default_port():
     assert url.default_port("http") == 80
     assert url.default_port(b"https") == 443

diff --git a/test/mitmproxy/proxy/layers/test_modes.py b/test/mitmproxy/proxy/layers/test_modes.py
@@ -171,6 +171,25 @@ def test_reverse_proxy(tctx, keep_host_header):
     assert server().address == ("localhost", 8000)
 
 
+def test_reverse_proxy_ipv6(tctx):
+    """Test that the host header of an IPv6 backend is bracketed."""
+    server = Placeholder(Server)
+    tctx.client.proxy_mode = ProxyMode.parse("reverse:http://[::1]:8000")
+    tctx.options.connection_strategy = "lazy"
+    assert (
+        Playbook(modes.ReverseProxy(tctx), hooks=False)
+        >> DataReceived(tctx.client, b"GET /foo HTTP/1.1\r\nHost: example.com\r\n\r\n")
+        << NextLayerHook(Placeholder(NextLayer))
+        >> reply_next_layer(lambda ctx: http.HttpLayer(ctx, HTTPMode.transparent))
+        << OpenConnection(server)
+        >> reply(None)
+        << SendData(server, b"GET /foo HTTP/1.1\r\nHost: [::1]:8000\r\n\r\n")
+        >> DataReceived(server, b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n")
+        << SendData(tctx.client, b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n")
+    )
+    assert server().address == ("::1", 8000)
+
+
 def test_reverse_dns(tctx):
     tctx.client.transport_protocol = "udp"
     tctx.server.transport_protocol = "udp"

diff --git a/test/mitmproxy/test_http.py b/test/mitmproxy/test_http.py
@@ -272,6 +272,24 @@ def test_url_options(self):
         request = treq(method=b"OPTIONS", path=b"*")
         assert request.url == "http://address:22"
 
+    def test_url_ipv6(self):
+        request = treq()
+        request.url = "https://[2001:db8::1]:8443/foo"
+        assert request.host == "2001:db8::1"
+        assert request.port == 8443
+        assert request.url == "https://[2001:db8::1]:8443/foo"
+        assert request.pretty_url == "https://[2001:db8::1]:8443/foo"
+
+    def test_host_header_ipv6(self):
+        request = treq()
+        request.headers["host"] = "address:22"
+        request.host = "::1"
+        assert request.headers["host"] == "[::1]:22"
+        request.port = 8080
+        assert request.headers["host"] == "[::1]:8080"
+        request.port = 80
+        assert request.headers["host"] == "[::1]"
+
     def test_url_authority(self):
         request = treq(method=b"CONNECT")
         assert request.url == "address:22"