Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

WebSocket upgrade to an HTTP/2 origin is sent as a plain GET

Aperta
  • Qualcosa non va?
#13,920 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

@bryancall ci sta già lavorando.

Dal 27/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

Bug HTTP/2 Websockets

Summary

When HTTP/2 to origin is enabled (proxy.config.ssl.client.alpn_protocols includes h2) and the origin negotiates h2, a WebSocket upgrade from an HTTP/1.1 client is sent to the origin as a plain HTTP/2 GET. The Connection and Upgrade headers are removed on the way out, so the origin answers 200 OK instead of 101 Switching Protocols, and the client gets that 200 with Connection: close. Nothing is logged as an error.

RFC 6455 upgrades only exist in HTTP/1.1, so ATS should send them to the origin over HTTP/1.1 even when h2 is offered.

Reproduction

ATS 10.2.1, TLS client on HTTP/1.1, TLS origin that offers h2,http/1.1 and answers a WebSocket upgrade with 101 when it arrives over HTTP/1.1.

records.yaml:

records:
  ssl:
    client:
      alpn_protocols: h2,http/1.1

remap.config:

map wss://ws2.test/ wss://127.0.0.1:48445/

Client request:

GET /feed HTTP/1.1
Host: ws2.test
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: <random>

Observed

The origin negotiates h2 and receives a GET with no Connection, no Upgrade and no :protocol pseudo-header. It replies 200, and the client receives:

HTTP/1.1 200 OK
Connection: close

The same request through the same rule works when the origin ALPN is limited to HTTP/1.1:

Origin ALPN offered by ATS Origin protocol Client result
h2,http/1.1 (global) h2 200 OK, no tunnel
unset HTTP/1.1 101, frames echo
http/1.1 set on the wss:// rule with conf_remap HTTP/1.1 101, frames echo, also with h2 sessions to that origin already pooled

Why

  • An upgrade request is not marked private, so HttpSM::do_http_server_open treats it as eligible for a multiplexed origin session (HttpSM.cc:6024) and offers the configured ALPN list (HttpSM.cc:6174).
  • When the request is converted to HTTP/2, VersionConverter::_remove_connection_specific_header_fields (VersionConverter.cc:298) drops Connection and Upgrade, as RFC 9113 requires. What is left is an ordinary GET.

Line numbers are from master at a42c6989ec.

Possible fix

Treat a WebSocket upgrade like a private session for origin selection: skip the multiplexed-session path and clear or restrict ALPN to http/1.1, the same as is_private() already does at HttpSM.cc:6174. Until then, the workaround is to set proxy.config.ssl.client.alpn_protocols=http/1.1 with conf_remap on each wss:// rule.

The HTTP/2 to origin documentation in #13693 could also note that WebSocket upgrades need HTTP/1.1 to the origin.

Related

Clients that connect to ATS over HTTP/2 cannot open a WebSocket at all, since ATS does not implement RFC 8441 extended CONNECT (SETTINGS_ENABLE_CONNECT_PROTOCOL is never advertised). RFC 8441 clients then fall back to HTTP/1.1, so that is a missing feature rather than this bug.

Lingua principale
C++
Stelle
2k
Fork
882
Merge medio
3g 19h
PR unite (30g)
113

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/trafficserver

Tutte le issue di apache/trafficserver

Issue simili

Altre issue su C++

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.