arturobernalg commented on PR #277:
URL: https://github.com/apache/tomcat/pull/277#issuecomment-6703987251
This is not a new PR, just an alternative for discussion. Following the
point that this belongs in `StreamProcessor.prepareHeaders`, I tried removing
the connection-specific header fields there when the response is prepared for
HTTP/2, instead of rejecting them in `Response.addHeader`. The Servlet API is
untouched (no exception) and HTTP/1.1 responses are unchanged, so the WebSocket
upgrade handshake is not affected. On HTTP/2 the `Connection: close` set by
`SpnegoAuthenticator` is now dropped, which RFC 9113 section 8.2.2 requires.
I tested it on current main with an h2c upgrade and a JSP that sets each
header. On main, curl exits with 92 for `Connection`, `Keep-Alive`,
`Proxy-Connection`, `Transfer-Encoding` and `Upgrade` ("Invalid HTTP header
field was received: name [connection]"). With the change, curl exits with 0 and
the headers are not sent.
A new unit test fails on main and passes with the change. All test classes
in `org.apache.coyote.http2` give the same results as main (the only failures,
`TestHttp2Section_5_1.testClosedInvalidFrame01` in both IO modes, also fail on
unmodified main), and the smoke profile passes.
The change also moves the existing request-side set from `Stream` to
`Constants` so both checks share it. It does not handle header fields named in
a `Connection` value and it logs nothing. I can add either, or log a warning
first as suggested earlier, if silent removal is not the right first step.
Branch:
https://github.com/arturobernalg/tomcat/tree/h2-response-connection-headers
@rmaucher @markt-asf could you let me know if this is worth turning into a
PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
