[go] net/http/httputil: don't forward Upgrade: h2c headers

0 views

Skip to first unread message

Gopher Robot (Gerrit)

unread,

1:51 PM (3 hours ago) 1:51 PM

to Damien Neil, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Nicholas Husin, Nicholas Husin, golang...@luci-project-accounts.iam.gserviceaccount.com, golang-co...@googlegroups.com

Gopher Robot submitted the change

Change information

Commit message:

net/http/httputil: don't forward Upgrade: h2c headers

Somewhat surprisingly, ReverseProxy will forward "Upgrade: h2c" headers
which attempt to switch an HTTP/1 connection to an unencrypted HTTP/2 one.
If the backend supports this deprecated protocol switch mechanism,
this lets a client send HTTP requests that bypass the ReverseProxy's
handlers. This is surprising at best, a security issue at worst.

Refuse to forward "Upgrade: h2c" headers.

In the unlikely event anyone actually wants this behavior,
they can use a Rewrite function to add the Upgrade: h2c
to the forwarded request.

Fixes #80416

Change-Id: I3a7d80fadf2eccbcce97f423556f8bf26a6a6964

Reviewed-on: https://go-review.googlesource.com/c/go/+/801722

LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>

Auto-Submit: Damien Neil <dn...@google.com>

Reviewed-by: Nicholas Husin <hu...@google.com>

Reviewed-by: Nicholas Husin <n...@golang.org>

Files:

M src/net/http/httputil/reverseproxy.go
M src/net/http/httputil/reverseproxy_test.go

Change size: M

Delta: 2 files changed, 51 insertions(+), 1 deletion(-)

Branch: refs/heads/master

Submit Requirements:

Code-Review: +1 by Nicholas Husin, +2 by Nicholas Husin
TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

open

diffy

satisfied_requirement

Reply all

Reply to author

Forward

0 new messages