Re: RFC 9113 and :authority header field

[Willy Tarreau <[e-mail]>]

On Thu, Jun 30, 2022 at 04:50:48PM +0200, Stefan Eissing wrote:
> > Am 30.06.2022 um 09:13 schrieb Willy Tarreau <[e-mail]>:
> > 
> > No, this one should not forge a :authority where there was not any,
> > it's the case that's covered by the "unless" rule in the spec, so
> > you'd get this:
> > 
> > H1 GET / HTTP/1.1, Host: example.com
> > -> H2 host: example.com, :scheme: <context>
> > -> H0 GET / HTTP/1.0, Host: example.com
> > -> H1 GET / HTTP/1.1, Host: example.com
> > 
> 
> I see. That is what you described as an "internal flag" to preserve that
> information in a gateway. And what is causing the problems at some CDNs
> (missing :authority). Thanks.
> 
> Well, since Apache httpd misses that flag our http2 proxy always sends
> :authority. I think I'll leave it that way until there is more acceptance of
> such a change.

That's reasonable. We've been doing this for quite some time (3 years
IIRC) and only got a few complaints, because you need to have another
H2->H1 gateway behind your reverse-proxy so that it starts to make a
difference, and when you're in infrastructures that start to chain
multiple H2 gateways, most often your final endpoints are HTTP/1.1
compliant and do not have issues with this.

Cheers,
Willy