net/http/httputil.ReverseProxy forwards Connection: Upgrade and Upgrade headers from client requests to the backend. When a client sends a request with an Upgrade: h2c header (indicating an upgrade to unencrypted HTTP/2) and the backend accepts it, the connection switches to HTTP/2. Subsequent traffic is then handled as raw bidirectional data, making the HTTP/2 frames invisible to
ReverseProxy and bypassing any path, host, or header restrictions enforced by Director or Rewrite.
Expected Behavior
According to the ReverseProxy documentation, hop-by-hop headers, including Upgrade, are removed from client requests.
Actual Behavior
Upgrade headers are forwarded to the backend, enabling h2c upgrades that result in HTTP/2 traffic being proxied without protocol awareness.
This was originally reported by Anthropic CVD.
cc @neild
net/http/httputil.ReverseProxyforwardsConnection: UpgradeandUpgradeheaders from client requests to the backend. When a client sends a request with anUpgrade: h2cheader (indicating an upgrade to unencrypted HTTP/2) and the backend accepts it, the connection switches to HTTP/2. Subsequent traffic is then handled as raw bidirectional data, making the HTTP/2 frames invisible toReverseProxyand bypassing any path, host, or header restrictions enforced byDirectororRewrite.Expected Behavior
According to the
ReverseProxydocumentation, hop-by-hop headers, includingUpgrade, are removed from client requests.Actual Behavior
Upgradeheaders are forwarded to the backend, enablingh2cupgrades that result in HTTP/2 traffic being proxied without protocol awareness.This was originally reported by Anthropic CVD.
cc @neild