Subject: Connection: header in HTTP/2

From: "Poul-Henning Kamp" <[email-masked]>
Date: Mon, 08 Sep 2014 07:18:48 +0000

I have been trying to figure out how the "Connection:" HTTP header
works in HTTP/2.0.

The Connection: header is strictly hop-by-hop, so we don't need to
consider version translation issues, it doesn't cross proxies.

In HTTP/1.1 the Connection: header is used for two things:  Marking
headers as hop-by-hop and managing TCP connections.

I think we should retain the ability to mark headers hop-by-hop.
I can see the benefit in being able to send headers only to the
first proxy.

Managing TCP connections is out-of-band in HTTP/2.0, so sending
"Connection: close" or "Connection: keepalive" inside a HTTP/2.0
multiplex doesn't make any sense, should not happen and I think
we should make that an explicit SHALL NOT.

The general way to do that would be to make it a stream-error in
HTTP/2.0 if Connection: tries to make a non-existent header hop-by-hop.

Thoughts ?

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
[email-masked]         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.

---

From: Willy Tarreau <[email-masked]>
Date: Tue, 9 Sep 2014 07:50:08 +0200

Hi Poul-Henning,

> HTTP/2.0 if Connection: tries to make a non-existent header hop-by-hop.

I don't think this extra check would provide any value, to be honnest. The
only real trouble we can have with Connection: is when it marks an end-to-end
header hoping that a further 1.1 proxy in the chain will remove it (eg: Host
after passing through filtering proxies).

Willy

---

From: "Poul-Henning Kamp" <[email-masked]>
Date: Tue, 09 Sep 2014 06:23:25 +0000

--------
In message <[email-masked]>, Willy Tarreau writes:

>I don't think this extra check would provide any value, to be honnest.

It would catch cases where people have messed up.

---

From: Willy Tarreau <[email-masked]>
Date: Tue, 9 Sep 2014 10:11:26 +0200

> It would catch cases where people have messed up.

Yes, but it's contrary to the principle of being liberal about what
you accept. I'd rather handle this header just like today : strip the
header fields referenced there, consider the special tokens if needed,
and ignore the rest.

Willy

---

From: "Poul-Henning Kamp" <[email-masked]>
Date: Tue, 09 Sep 2014 08:24:56 +0000

--------
In message <[email-masked]>, Willy Tarreau writes:
>you accept.

Can we at least implement the "be conservative" part and tell people
that "Connection: close" will not work ?

---

From: Willy Tarreau <[email-masked]>
Date: Tue, 9 Sep 2014 10:27:16 +0200

> that "Connection: close" will not work ?

Yes I think that's quite reasonable. I'd even say that the SHOULD NOT
emit connection: close nor connection: keep-alive. This can easily
happen in 1.x->2.0 gateways/proxies.

Willy