This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch 11.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/11.0.x by this push:
new 85829f8b5f Ignore the HTTP/2 upgrade request in HTTP/1.0 requests
(#1111)
85829f8b5f is described below
commit 85829f8b5f7376e71a22046906a3a2a8cab27973
Author: Arturo Bernal <[email protected]>
AuthorDate: Thu Nov 5 18:23:07 2026 +0100
Ignore the HTTP/2 upgrade request in HTTP/1.0 requests (#1111)
RFC 9110, section 7.8 requires a server to ignore an Upgrade header
field received in an HTTP/1.0 request. The h2c upgrade was accepted
whatever the HTTP version of the request. Only consider the upgrade
for HTTP/1.1 requests.
---
java/org/apache/coyote/http11/Http11Processor.java | 5 +++--
test/org/apache/coyote/http2/TestHttp2Section_3_2.java | 18 ++++++++++++++++++
2 files changed, 21 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/coyote/http11/Http11Processor.java
b/java/org/apache/coyote/http11/Http11Processor.java
index f4b82e6549..028a0d036e 100644
--- a/java/org/apache/coyote/http11/Http11Processor.java
+++ b/java/org/apache/coyote/http11/Http11Processor.java
@@ -337,8 +337,9 @@ public class Http11Processor extends AbstractProcessor {
setErrorState(ErrorState.CLOSE_CLEAN, t);
}
- // Has an upgrade been requested?
- if (isConnectionToken(request.getMimeHeaders(), "upgrade")) {
+ // Has an upgrade been requested? An Upgrade header field in an
HTTP/1.0 request must be ignored
+ // (RFC 9110, section 7.8)
+ if (http11 && isConnectionToken(request.getMimeHeaders(),
"upgrade")) {
// Check the protocol
String requestedProtocol = request.getHeader("Upgrade");
diff --git a/test/org/apache/coyote/http2/TestHttp2Section_3_2.java
b/test/org/apache/coyote/http2/TestHttp2Section_3_2.java
index fa1c15baf0..5532f2e547 100644
--- a/test/org/apache/coyote/http2/TestHttp2Section_3_2.java
+++ b/test/org/apache/coyote/http2/TestHttp2Section_3_2.java
@@ -41,6 +41,24 @@ public class TestHttp2Section_3_2 extends Http2TestBase {
}
+ /*
+ * RFC 9110, section 7.8: A server that receives an Upgrade header field
in an HTTP/1.0 request MUST ignore that
+ * Upgrade field.
+ */
+ @Test
+ public void testConnectionUpgradeHttp10() throws Exception {
+ enableHttp2();
+ configureAndStartWebApplication();
+ openClientConnection();
+ byte[] upgradeRequest = ("GET /simple HTTP/1.0\r\n" + "Host:
localhost:" + getPort() + "\r\n" +
+ "Connection: " + DEFAULT_CONNECTION_HEADER_VALUE + "\r\n" +
"Upgrade: h2c\r\n" +
+ EMPTY_HTTP2_SETTINGS_HEADER +
"\r\n").getBytes(StandardCharsets.ISO_8859_1);
+ os.write(upgradeRequest);
+ os.flush();
+ parseHttp11Response();
+ }
+
+
@Test
public void testConnectionUpgradeWrongProtocol() throws Exception {
enableHttp2();
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
