What is 421 Misdirected Request?

Short answer

421 Misdirected Request is the HTTP status code that reports that the request was directed to a server or connection that cannot produce a response for that address (RFC 9110); the client can retry the request over a new or the correct connection. The typical case is that, in HTTPS, the domain reported with SNI in the TLS handshake differs from the Host header in the HTTP request. In TR7, if SNI/Host Validation in the TLS Security Profile is on (off by default), requests that come to the HTTP vService and whose SNI and Host do not match are rejected with 421: an HTTP/2 request is answered with the 421 status code, and an HTTP/1.x request with a 421 Misdirected Request body and a Connection: close header that closes the connection. In the comparison, the port in the Host is ignored and case differences are not taken into account; if the client has not sent SNI, no validation is performed.

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → TLS Security Profiles → profile form → Frontend-only Settings	SNI/Host Validation (off by default)	Returning 421 on an SNI and Host mismatch
Load Balancer → Load Balancer vService List → HTTP vService form	SSL Security	Assigning the profile to a vService with an HTTPS frontend
Left Monitor Panel → Load Balancer vServices → vService → Logs & Tracking → HTTP Logs	Filter → Status code = 421	Seeing the rejected requests (Log must be on in the vService)

Configuration steps and the domain fronting scenario: Can I reject requests whose SNI and Host Header do not match (domain fronting) (SNI/Host Validation)?

Common Misconceptions

• "421 is a server error." It is in the 4xx class; it reports that the request came over the wrong connection.
• "A client that does not send SNI also gets 421." If there is no SNI, no validation is performed.
• "A www.example.com:8443 Host does not match a www.example.com SNI." In the comparison, the port in the Host is ignored and letter case is not taken into account; this request is accepted.
• "The validation also works on an L7 TCP vService." SNI/Host validation is applied only on an HTTP vService; an L7 TCP vService does not read the HTTP Host header.

How it is done in the documentation

• TLS Security Profiles · SNI/Host Validation
• HTTP (L7) vService · SSL Security

Related questions

• Can I reject requests whose SNI and Host Header do not match (domain fronting) (SNI/Host Validation)?
• What is SNI (Server Name Indication)?
• What is the Host Header?
• What is an HTTP status code; what do the 2xx, 3xx, 4xx and 5xx classes describe?