Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

WebSocket upgrade to an HTTP/2 origin is sent as a plain GET

Abierto
  • ¿Algo no está bien?
#13,920 0 comentarios 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 2 días

@bryancall ya está trabajando en esto.

Desde el 27/10/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

Bug HTTP/2 Websockets

Summary

When HTTP/2 to origin is enabled (proxy.config.ssl.client.alpn_protocols includes h2) and the origin negotiates h2, a WebSocket upgrade from an HTTP/1.1 client is sent to the origin as a plain HTTP/2 GET. The Connection and Upgrade headers are removed on the way out, so the origin answers 200 OK instead of 101 Switching Protocols, and the client gets that 200 with Connection: close. Nothing is logged as an error.

RFC 6455 upgrades only exist in HTTP/1.1, so ATS should send them to the origin over HTTP/1.1 even when h2 is offered.

Reproduction

ATS 10.2.1, TLS client on HTTP/1.1, TLS origin that offers h2,http/1.1 and answers a WebSocket upgrade with 101 when it arrives over HTTP/1.1.

records.yaml:

records:
  ssl:
    client:
      alpn_protocols: h2,http/1.1

remap.config:

map wss://ws2.test/ wss://127.0.0.1:48445/

Client request:

GET /feed HTTP/1.1
Host: ws2.test
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: <random>

Observed

The origin negotiates h2 and receives a GET with no Connection, no Upgrade and no :protocol pseudo-header. It replies 200, and the client receives:

HTTP/1.1 200 OK
Connection: close

The same request through the same rule works when the origin ALPN is limited to HTTP/1.1:

Origin ALPN offered by ATS Origin protocol Client result
h2,http/1.1 (global) h2 200 OK, no tunnel
unset HTTP/1.1 101, frames echo
http/1.1 set on the wss:// rule with conf_remap HTTP/1.1 101, frames echo, also with h2 sessions to that origin already pooled

Why

  • An upgrade request is not marked private, so HttpSM::do_http_server_open treats it as eligible for a multiplexed origin session (HttpSM.cc:6024) and offers the configured ALPN list (HttpSM.cc:6174).
  • When the request is converted to HTTP/2, VersionConverter::_remove_connection_specific_header_fields (VersionConverter.cc:298) drops Connection and Upgrade, as RFC 9113 requires. What is left is an ordinary GET.

Line numbers are from master at a42c6989ec.

Possible fix

Treat a WebSocket upgrade like a private session for origin selection: skip the multiplexed-session path and clear or restrict ALPN to http/1.1, the same as is_private() already does at HttpSM.cc:6174. Until then, the workaround is to set proxy.config.ssl.client.alpn_protocols=http/1.1 with conf_remap on each wss:// rule.

The HTTP/2 to origin documentation in #13693 could also note that WebSocket upgrades need HTTP/1.1 to the origin.

Related

Clients that connect to ATS over HTTP/2 cannot open a WebSocket at all, since ATS does not implement RFC 8441 extended CONNECT (SETTINGS_ENABLE_CONNECT_PROTOCOL is never advertised). RFC 8441 clients then fall back to HTTP/1.1, so that is a missing feature rather than this bug.

Lenguaje dominante
C++
Estrellas
2k
Forks
882
Merge medio
3 d 22 h
PR fusionados (30 d)
111

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/trafficserver

Todos los issues de apache/trafficserver

Issues similares

Más issues de C++

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.