Skip to content

Commit 76da649

Browse files
odeke-embradfitz
authored andcommitted
doc/go1.7.html: document that http.Server now enforces request versions
Document that the http.Server is now stricter about rejecting requests with invalid HTTP versions, and also that it rejects plaintext HTTP/2 requests, except for `PRI * HTTP/2.0` upgrade requests. The relevant CL is https://golang.org/cl/24505. Updates #15810. Change-Id: Ibbace23e001b5e2eee053bd341de50f9b6d3fde8 Reviewed-on: https://go-review.googlesource.com/24731 Reviewed-by: Brad Fitzpatrick <[email protected]>
1 parent 2fcb25e commit 76da649

File tree

1 file changed

+7
-0
lines changed

1 file changed

+7
-0
lines changed

doc/go1.7.html

+7
Original file line numberDiff line numberDiff line change
@@ -896,6 +896,13 @@ <h3 id="minor_library_changes">Minor changes to the library</h3>
896896
is set explicitly, following <a href="https://tools.ietf.org/html/rfc7230#section-3.3.1">RFC 7230</a>.
897897
</p>
898898

899+
<p>
900+
The server implementation is now stricter about rejecting requests with invalid HTTP versions.
901+
Invalid requests claiming to be HTTP/0.x are now rejected (HTTP/0.9 was never fully supported),
902+
and plaintext HTTP/2 requests other than the "PRI * HTTP/2.0" upgrade request are now rejected as well.
903+
The server continues to handle encrypted HTTP/2 requests.
904+
</p>
905+
899906
<p>
900907
In the server, a 200 status code is sent back by the timeout handler on an empty
901908
response body, instead of sending back 0 as the status code.

0 commit comments

Comments
 (0)