This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new dfb8ac61b4 Do not upgrade to WebSocket for HTTP/1.0 requests (#1112)
dfb8ac61b4 is described below
commit dfb8ac61b4fbfd8eb7d46f6c09a2d343fd816b8c
Author: Arturo Bernal <[email protected]>
AuthorDate: Thu Nov 5 18:28:34 2026 +0100
Do not upgrade to WebSocket for HTTP/1.0 requests (#1112)
RFC 9110, section 7.8 requires a server to ignore an Upgrade header
field received in an HTTP/1.0 request and RFC 6455, section 4.2.1
requires the opening handshake to use HTTP/1.1 or later. The handshake
was completed with a 101 response whatever the HTTP version of the
request. Do not treat an HTTP/1.0 request as a WebSocket upgrade request.
---
.../tomcat/websocket/server/UpgradeUtil.java | 7 ++-
.../websocket/server/TestUpgradeHttpVersion.java | 68 ++++++++++++++++++++++
2 files changed, 73 insertions(+), 2 deletions(-)
diff --git a/java/org/apache/tomcat/websocket/server/UpgradeUtil.java
b/java/org/apache/tomcat/websocket/server/UpgradeUtil.java
index 9b6e4013ee..9f1b17cecf 100644
--- a/java/org/apache/tomcat/websocket/server/UpgradeUtil.java
+++ b/java/org/apache/tomcat/websocket/server/UpgradeUtil.java
@@ -69,7 +69,9 @@ public class UpgradeUtil {
* Checks to see if this is an HTTP request that includes a valid upgrade
request to web socket.
* <p>
* Note: RFC 2616 does not limit HTTP upgrade to GET requests but the Java
WebSocket spec 1.0, section 8.2 implies
- * such a limitation and RFC 6455 section 4.1 requires that a WebSocket
Upgrade uses GET.
+ * such a limitation and RFC 6455 section 4.1 requires that a WebSocket
Upgrade uses GET. RFC 6455 section 4.2.1
+ * requires HTTP/1.1 or later and RFC 9110 section 7.8 requires an Upgrade
header field in an HTTP/1.0 request to be
+ * ignored.
*
* @param request The request to check if it is an HTTP upgrade request
for a WebSocket connection
* @param response The response associated with the request
@@ -82,7 +84,8 @@ public class UpgradeUtil {
return ((request instanceof HttpServletRequest) && (response
instanceof HttpServletResponse) &&
headerContainsToken((HttpServletRequest) request,
Constants.UPGRADE_HEADER_NAME,
Constants.UPGRADE_HEADER_VALUE) &&
- Method.GET.equals(((HttpServletRequest) request).getMethod()));
+ Method.GET.equals(((HttpServletRequest) request).getMethod())
&&
+ !"HTTP/1.0".equals(request.getProtocol()));
}
diff --git
a/test/org/apache/tomcat/websocket/server/TestUpgradeHttpVersion.java
b/test/org/apache/tomcat/websocket/server/TestUpgradeHttpVersion.java
new file mode 100644
index 0000000000..46b931a651
--- /dev/null
+++ b/test/org/apache/tomcat/websocket/server/TestUpgradeHttpVersion.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tomcat.websocket.server;
+
+import java.nio.charset.StandardCharsets;
+
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.websocket.CloseReason.CloseCodes;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+import org.apache.tomcat.websocket.TesterEchoServer;
+import org.apache.tomcat.websocket.WebSocketBaseTest;
+
+/**
+ * RFC 9110, section 7.8 requires a server to ignore an Upgrade header field
received in an HTTP/1.0 request and RFC
+ * 6455, section 4.2.1 requires the WebSocket opening handshake to use
HTTP/1.1 or later.
+ */
+public class TestUpgradeHttpVersion extends WebSocketBaseTest {
+
+ @Test
+ public void testHttp11() throws Exception {
+ Assert.assertEquals(HttpServletResponse.SC_SWITCHING_PROTOCOLS,
doTest("HTTP/1.1"));
+ }
+
+
+ @Test
+ public void testHttp10() throws Exception {
+ Assert.assertNotEquals(HttpServletResponse.SC_SWITCHING_PROTOCOLS,
doTest("HTTP/1.0"));
+ }
+
+
+ private int doTest(String httpVersion) throws Exception {
+ startServer(TesterEchoServer.Config.class);
+
+ TesterWsClient client = new TesterWsClient("localhost", getPort());
+ String req =
client.createUpgradeRequest(TesterEchoServer.Config.PATH_BASIC)
+ .replaceFirst(" HTTP/1\\.1", " " + httpVersion);
+ client.write(req.getBytes(StandardCharsets.UTF_8));
+ int rc = client.readUpgradeResponse();
+
+ if (rc == HttpServletResponse.SC_SWITCHING_PROTOCOLS) {
+ client.sendCloseFrame(CloseCodes.NORMAL_CLOSURE);
+ // Read (and ignore) the response
+ byte[] buf = new byte[256];
+ while (client.read(buf) > 0) {
+ // Ignore
+ }
+ }
+ client.closeSocket();
+ return rc;
+ }
+}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
