Re: HTTP/2 Upgrade with content?

"Jason T. Greene" <> Fri, 13 March 2015 08:33 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id C6AE81A1AB2 for <>; Fri, 13 Mar 2015 01:33:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.911
X-Spam-Status: No, score=-6.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id f-Z5Cp5ySZZB for <>; Fri, 13 Mar 2015 01:33:23 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id CB4DD1A1AB4 for <>; Fri, 13 Mar 2015 01:33:23 -0700 (PDT)
Received: from lists by with local (Exim 4.80) (envelope-from <>) id 1YWKyF-0000XT-74 for; Fri, 13 Mar 2015 08:29:27 +0000
Resent-Date: Fri, 13 Mar 2015 08:29:27 +0000
Resent-Message-Id: <>
Received: from ([]) by with esmtp (Exim 4.80) (envelope-from <>) id 1YWKy7-0000WR-ME for; Fri, 13 Mar 2015 08:29:19 +0000
Received: from ([]) by with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.72) (envelope-from <>) id 1YWKy5-0003ip-Rt for; Fri, 13 Mar 2015 08:29:19 +0000
Received: from ( []) by (8.13.8/8.13.8) with ESMTP id t2D8Sk6S018355; Fri, 13 Mar 2015 04:28:46 -0400
Content-Type: multipart/alternative; boundary="Apple-Mail-04295F23-83C3-4310-87C6-6BBBF55647A5"
Content-Transfer-Encoding: 7bit
From: "Jason T. Greene" <>
MIME-Version: 1.0
Message-Id: <>
Date: Fri, 13 Mar 2015 04:28:46 -0400
References: <>
To: Greg Wilkins <>
In-Reply-To: <>
Cc: HTTP Working Group <>
X-Mailer: Zimbra 8.0.6_GA_5922 (MobileSync - Apple-iPhone7C1/1202.466)
Thread-Topic: HTTP/2 Upgrade with content?
Thread-Index: cTLS02xflnL+Ax1vweDNMrpyFMXo9Q==
Received-SPF: pass client-ip=;;
X-W3C-Hub-Spam-Status: No, score=-5.9
X-W3C-Scan-Sig: 1YWKy5-0003ip-Rt 8a0de0b1e8d08dd8fb519626513772b2
Subject: Re: HTTP/2 Upgrade with content?
Archived-At: <>
X-Mailing-List: <> archive/latest/28951
Precedence: list
List-Id: <>
List-Help: <>
List-Post: <>
List-Unsubscribe: <>

What about draining the content and after the 101 the h2 response sends a 307?

> On Mar 12, 2015, at 6:14 PM, Greg Wilkins <> wrote:
> Section 3.2 describes the upgrade to HTTP/2 and it allows support for upgrade requests with bodies:
>    Requests that contain an entity body MUST be sent in their entirety
>    before the client can send HTTP/2 frames. This means that a large
>    request entity can block the use of the connection until it is
>    completely sent.
> Servers will need to protect themselves from DoS attacks via such requests as buffering arbitrary large content in their entirety is a commitment that servers cannot generally give.
> Thus servers will have to limit the size of the entities they are prepared to hold in this situation (and the size of a single normal request buffers is probably the memory commitment they are prepared to make for any given connection).
> My question is, what should a server do if it receives an otherwise valid upgrade request that it could handle but with content that exceeds this memory limit?      Should it respond with a 413 REQUEST_ENTITY_TOO_LARGE or should it just ignore the upgrade and let the request be handled via HTTP/1.1 (which can stream the content into the request handler and it becomes somebody else's problem to limit memory usage).
> My problem with ignoring the upgrade is that it is an arbitrary limit and it will be hard for clients to tell why some upgrades work and others do not.
> Alternately my problem with 413 is that some servers might wish to avoid the whole upgrade with content path and thus send a 413 for any upgrade with content, which may break some clients that could otherwise proceed with HTTP/1.1
> thoughts?
> PS. in hindsight, I would rather that we had not allowed upgrades with content and instead told clients to upgrade with an OPTION request prior to any PUT/POST request.... gallop... gallop... gallop.... SLAM!
> -- 
> Greg Wilkins <>  @  Webtide - an Intalio subsidiary
> HTTP, SPDY, Websocket server and client that scales
>  advice and support for jetty and cometd.