Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

WebSocket upgrade to an HTTP/2 origin is sent as a plain GET

Đang mở
  • Có gì không ổn?
#13,920 0 bình luận 0 reaction 1 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 2 ngày

@bryancall đang làm issue này rồi.

Từ ngày 27/10/2026.

Đánh giá

Issue này chưa được đánh giá.

Mô tả

Bug HTTP/2 Websockets

Summary

When HTTP/2 to origin is enabled (proxy.config.ssl.client.alpn_protocols includes h2) and the origin negotiates h2, a WebSocket upgrade from an HTTP/1.1 client is sent to the origin as a plain HTTP/2 GET. The Connection and Upgrade headers are removed on the way out, so the origin answers 200 OK instead of 101 Switching Protocols, and the client gets that 200 with Connection: close. Nothing is logged as an error.

RFC 6455 upgrades only exist in HTTP/1.1, so ATS should send them to the origin over HTTP/1.1 even when h2 is offered.

Reproduction

ATS 10.2.1, TLS client on HTTP/1.1, TLS origin that offers h2,http/1.1 and answers a WebSocket upgrade with 101 when it arrives over HTTP/1.1.

records.yaml:

records:
  ssl:
    client:
      alpn_protocols: h2,http/1.1

remap.config:

map wss://ws2.test/ wss://127.0.0.1:48445/

Client request:

GET /feed HTTP/1.1
Host: ws2.test
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: <random>

Observed

The origin negotiates h2 and receives a GET with no Connection, no Upgrade and no :protocol pseudo-header. It replies 200, and the client receives:

HTTP/1.1 200 OK
Connection: close

The same request through the same rule works when the origin ALPN is limited to HTTP/1.1:

Origin ALPN offered by ATS Origin protocol Client result
h2,http/1.1 (global) h2 200 OK, no tunnel
unset HTTP/1.1 101, frames echo
http/1.1 set on the wss:// rule with conf_remap HTTP/1.1 101, frames echo, also with h2 sessions to that origin already pooled

Why

  • An upgrade request is not marked private, so HttpSM::do_http_server_open treats it as eligible for a multiplexed origin session (HttpSM.cc:6024) and offers the configured ALPN list (HttpSM.cc:6174).
  • When the request is converted to HTTP/2, VersionConverter::_remove_connection_specific_header_fields (VersionConverter.cc:298) drops Connection and Upgrade, as RFC 9113 requires. What is left is an ordinary GET.

Line numbers are from master at a42c6989ec.

Possible fix

Treat a WebSocket upgrade like a private session for origin selection: skip the multiplexed-session path and clear or restrict ALPN to http/1.1, the same as is_private() already does at HttpSM.cc:6174. Until then, the workaround is to set proxy.config.ssl.client.alpn_protocols=http/1.1 with conf_remap on each wss:// rule.

The HTTP/2 to origin documentation in #13693 could also note that WebSocket upgrades need HTTP/1.1 to the origin.

Related

Clients that connect to ATS over HTTP/2 cannot open a WebSocket at all, since ATS does not implement RFC 8441 extended CONNECT (SETTINGS_ENABLE_CONNECT_PROTOCOL is never advertised). RFC 8441 clients then fall back to HTTP/1.1, so that is a missing feature rather than this bug.

Ngôn ngữ chính
C++
Star
2k
Fork
882
Merge trung bình
3 ngày 22 giờ
Pull request đã merge (30 ngày)
111

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của apache/trafficserver

Tất cả issue của apache/trafficserver

Issue tương tự

Thêm issue về C++

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.