This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/pekko-http.git
The following commit(s) were added to refs/heads/main by this push:
new 49085e69f enable by default -
pekko.http.server.http2.frame-type-throttle.frame-types = ["reset"] (#1193)
49085e69f is described below
commit 49085e69f4aec38990c8137504ced3693bc5152c
Author: PJ Fanning <[email protected]>
AuthorDate: Tue Aug 4 18:43:26 2026 +0100
enable by default - pekko.http.server.http2.frame-type-throttle.frame-types
= ["reset"] (#1193)
* enable by default -
pekko.http.server.http2.frame-type-throttle.frame-types = ["reset"]
* Update Http2ServerDisableFrameTypeThrottleSpec.scala
---
http-core/src/main/resources/reference.conf | 7 ++++---
.../engine/http2/Http2ServerDisableFrameTypeThrottleSpec.scala | 3 ++-
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/http-core/src/main/resources/reference.conf
b/http-core/src/main/resources/reference.conf
index 74bb229ed..1c7019879 100644
--- a/http-core/src/main/resources/reference.conf
+++ b/http-core/src/main/resources/reference.conf
@@ -316,10 +316,11 @@ pekko.http {
frame-type-throttle {
# Configure the throttle for non-data frame types
(https://github.com/apache/pekko-http/issues/332).
- # The supported frame-types for throttlng are:
+ # The supported frame-types for throttling are:
# reset, headers, continuation, go-away, priority, ping, push-promise,
window-update
- # If you are concerned about CVE-2023-44487, you could set:
pekko.http.server.http2.frame-type-throttle.frame-types = ["reset"]
- frame-types = []
+ # By default, RST_STREAM frames are throttled to mitigate HTTP/2 Rapid
Reset attacks (CVE-2023-44487).
+ # Set to [] to disable throttling.
+ frame-types = ["reset"]
cost = 100
burst = 100
# interval must be a positive duration
diff --git
a/http2-tests/src/test/scala/org/apache/pekko/http/impl/engine/http2/Http2ServerDisableFrameTypeThrottleSpec.scala
b/http2-tests/src/test/scala/org/apache/pekko/http/impl/engine/http2/Http2ServerDisableFrameTypeThrottleSpec.scala
index ee399de80..7b02552c9 100644
---
a/http2-tests/src/test/scala/org/apache/pekko/http/impl/engine/http2/Http2ServerDisableFrameTypeThrottleSpec.scala
+++
b/http2-tests/src/test/scala/org/apache/pekko/http/impl/engine/http2/Http2ServerDisableFrameTypeThrottleSpec.scala
@@ -21,10 +21,11 @@ import pekko.http.impl.engine.http2.framing.FrameRenderer
import pekko.util.ByteStringBuilder
/**
- * This tests the http2 server throttle support for rapid resets is disabled
by default.
+ * This tests the http2 server throttle support for rapid resets when
explicitly disabled.
*/
class Http2ServerDisableFrameTypeThrottleSpec extends
Http2SpecWithMaterializer("""
pekko.http.server.http2.log-frames = on
+ pekko.http.server.http2.frame-type-throttle.frame-types = []
""") {
override def failOnSevereMessages: Boolean = true
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
