Valid HTTP/1.1 request causes 503 Backend fetch failed #4314

Activity

1. dridi commented on Apr 14, 2025

   

   dridi

   on Apr 14, 2025

   Member

   More actions

   We have #4125 in progress currently postponed for other HTTP/2 changes. Since you are one of the rare trailers users, would you like to give it a try once ready? We currently have no ETA though.

   Out of curiosity, is your use case gRPC or something else?
2. DemiMarie commented on Apr 14, 2025

   

   DemiMarie

   on Apr 14, 2025

   Author

   More actions

   I’m sending deliberately weird requests (both valid and invalid) to various HTTP implementations to see how they react. So far I have found:

   • NGINX and HAProxy allow control characters in field values (though not CR, LF, or NUL).
   • NGINX allows forbidden header and trailer names in HTTP/2+.
   • HAProxy allows some forbidden header and trailer names in HTTP/2+.
   • Varnish doesn’t check seem to check for forbidden header names in HTTP/2.
   • NGINX drops HTTP/1.x trailers in requests, and does not check them for even basic syntactic validity. I have not tested HTTP/2 trailers. Trailers in responses can be passed through or dropped.
   • HAProxy always keeps trailers.
   • Varnish can’t handle trailers at all and fails with a misleading error message and nothing useful in the logs.
   • Go, Hyper, HAProxy, and NGINX allow leading and/or trailing whitespace in HTTP/2+ field values. I can use this to make an upstream and downstream disagree on the exact value of a field value.
   • NGINX allows HTTP/1.x field values to start or end with a tab.
   • At least Go, HAProxy, and NGINX will allow HTTP/1.1 chunk extensions to contain almost anything that is not a newline, including (for at least HAProxy and NGINX) NUL bytes.
   • nghttp3 drops the entire field if it has a bad value and is not a pseudo-header.
   • Google’s Quiche accepts malformed HTTP/3 headers.

   HTTP really needs a conformance test suite.

   👍React with 👍1Reacted by Nils Goroll
3. dridi commented on Apr 14, 2025

   

   dridi

   on Apr 14, 2025

   Member

   More actions

   In that case it would be interesting to learn more about the offending header names we allow for h2.

   Could you perform your trailer tests on #4125? It's not ready to merge, but it would at least be interesting to see how it fares in its current shape with your conformance endeavor.
4. DemiMarie commented on Apr 16, 2025

   

   DemiMarie

   on Apr 16, 2025

   Author

   More actions

   transfer-encoding (even if not chunked!), upgrade, connection, keep-alive, and proxy-connection are all accepted. The last is even passed to the backend.