[net] internal/http3: make server reject connection-related headers

0 views

Skip to first unread message

Nicholas Husin (Gerrit)

unread,

Apr 29, 2026, 2:14:17 PM (23 hours ago) Apr 29

to goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Nicholas Husin, Damien Neil, golang...@luci-project-accounts.iam.gserviceaccount.com, golang-co...@googlegroups.com

Nicholas Husin submitted the change

Change information

Commit message:

internal/http3: make server reject connection-related headers

Per RFC 9114, connection-related headers are considered malformed. The
only exception is "TE" header field which is fine only if it has a value
of "trailers".

For golang/go#70914

Change-Id: I44ad0b562b287c7d2725269777af76636a6a6964

Reviewed-on: https://go-review.googlesource.com/c/net/+/771420

Reviewed-by: Nicholas Husin <hu...@google.com>

LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>

Reviewed-by: Damien Neil <dn...@google.com>

Files:

M internal/http3/server.go
M internal/http3/server_test.go

Change size: M

Delta: 2 files changed, 100 insertions(+), 16 deletions(-)

Branch: refs/heads/master

Submit Requirements:

Code-Review: +2 by Damien Neil, +1 by Nicholas Husin
TryBots-Pass: LUCI-TryBot-Result+1 by golang...@luci-project-accounts.iam.gserviceaccount.com

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

open

diffy

satisfied_requirement

Reply all

Reply to author

Forward

0 new messages