HTTP/2 headers should not be included in snippets

未关闭
#298 0 条评论 1 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
35/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
停滞
技术栈
typescript
领域
tooling

调研方向

首先跟踪 HAR 数据如何加载到请求 headers 中,以及这些 headers 如何传递给 snippet 生成器。重现示例 HTTP/2 HAR 输入并比较生成的 curl 输出,然后验证 :authority 和 :method 等伪 headers 会被排除,同时不会删除普通 headers。

由索引模型根据 Issue 内容生成。

描述

It doesn't seem to be explicitly specified anywhere, but when exporting a HAR file for HTTP/2 traffic, it seems that most clients (e.g. Chrome) do include the HTTP/2 pseudo-headers in the header data. These are headers like :authority and :method.

This makes sense for HAR files, when you want an accurate recording of the full traffic details, but these shouldn't be included in HTTP snippets imo. Most clients will reject them completely, for example this curl command generated by httpsnippet will always fail, even though the original request worked fine:

curl --request GET \
  --url https://google.com/ \
  --header ':authority: google.com' \
  --header ':method: GET' \
  --header ':path: /' \
  --header ':scheme: https' \
  --header 'accept: */*' \
  --header 'user-agent: curl/7.68.0'

These headers are basically duplicating the method & URL parts, which we include separately anyway. They're just a detail of how the method & URL are sent in HTTP/2. They also won't work because I think in every snippet here we're sending pure HTTP/1 requests, where these are generally illegal header names anyway (which I guess is why curl fails here).

I would suggest we filter these out, i.e. drop all headers starting with : when we load data from the HAR. That will never happen in HTTP/1 traffic, and in HTTP/2 traffic it's almost always redundant, and the rare cases where it's not are very weird (I think sending a request to one domain but with a :authority header for different domain is the only possible example?).

Alternatively, we could try to fully translate HTTP/2 data back into the exactly equivalent HTTP/1 requests. I wrote a blog post about that a while back here: https://httptoolkit.tech/blog/translating-http-2-into-http-1/#translating-one-to-the-other. That would just be the first HTTP/2 -> HTTP/1 list, under 'Translating one to the other', and only half are relevant, so I think it's relatively simple, but it's still more complicated than just dropping the headers, and it might plausibly have other side effects.

What do you think?

主要语言
TypeScript
星标
1.2k
派生
242
PR 合并指标
30 天内没有已合并 PR

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue,再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库,在一个分支上完成修改。
  4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

Kong/httpsnippet 的其他 Issue

查看 Kong/httpsnippet 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。