Repository navigation
fix: use HTTP/1.1 for cleartext requests through a forward proxy - #1578
Merged
Merged
Conversation
Collaborator
Author
|
Full module |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues remain for the proxy-specific HTTP/1.1 fallback.
No open issues 🎉
What changed in this PR
Fixes #1571 by making the Netty client use HTTP/1.1 for cleartext requests through a forward proxy in HTTP2 mode, while preserving HTTP/2 negotiation for HTTPS through CONNECT tunnels.
Changes:
- Adds the forward-proxy fallback with FINE-level logging and documents the exception to
HTTP2mode. - Adds a regression test verifying HTTP/1.1 forwarding with an absolute-form request target.
- Records the fix in the changes log.
| File | Description |
|---|---|
org.restlet/src/test/java/org/restlet/engine/connector/ProxyTestCase.java |
Tests cleartext forwarding in HTTP2 mode. |
org.restlet/src/main/java/org/restlet/engine/netty/NettyClientHelper.java |
Implements and documents the proxy-specific HTTP/1.1 fallback. |
changes.md |
Adds the bug-fix entry for #1571. |
Review effort: Balanced
jlouvel
force-pushed
the
fix/netty-non-proxy-hosts
branch
from
October 31, 2026 07:44
a3b9e8d to
599b447
Compare
jlouvel
force-pushed
the
fix/netty-http2-forward-proxy
branch
from
October 31, 2026 07:44
1a8d097 to
cb75355
Compare
jlouvel
force-pushed
the
fix/netty-non-proxy-hosts
branch
from
November 1, 2026 14:56
599b447 to
fac8722
Compare
jlouvel
force-pushed
the
fix/netty-http2-forward-proxy
branch
from
November 1, 2026 14:56
cb75355 to
9daac3e
Compare
In the HTTP2 transport mode, the Netty client sent the HTTP/2 connection preface (prior knowledge) to the forward proxy for http:// requests. HTTP proxies generally only speak HTTP/1.1 to clients, so these requests failed. - NettyClientHelper: cleartext connections to a forward proxy use HTTP/1.1 with absolute-form request targets, logged at FINE level. HTTPS requests through CONNECT tunnels still negotiate HTTP/2 with ALPN. - ProxyTestCase: HTTP2 mode request through the forward proxy. Closes #1571. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Jerome Louvel <[email protected]>
Co-Authored-By: Claude Opus 5.5 <[email protected]>
jlouvel
force-pushed
the
fix/netty-non-proxy-hosts
branch
from
November 1, 2026 16:18
fac8722 to
2bd2e6f
Compare
jlouvel
force-pushed
the
fix/netty-http2-forward-proxy
branch
from
November 1, 2026 16:18
9daac3e to
e46e56b
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1571. Based on #1577.
With
httpClientTransportMode=HTTP2, the Netty client sent the HTTP/2 connection preface (prior knowledge) to the forward proxy forhttp://requests. HTTP proxies such as Squid and most corporate proxies only speak HTTP/1.1 to clients, so these requests failed.Changes
NettyClientHelper: cleartext connections to a forward proxy now use HTTP/1.1 with absolute-form request targets, and this is logged at FINE level.initConnection()now gets the proxy for both schemes and decides between tunnel and forward proxy itself. HTTPS requests through CONNECT tunnels still negotiate HTTP/2 with ALPN. ThehttpClientTransportModeJavadoc is updated.ProxyTestCase: a request inHTTP2mode through the forward proxy.changes.md: entry under Bugs fixed.I chose falling back over failing fast.
HTTP2mode is described as "HTTP/2 only", but a request that cannot work at all is less useful than one going out over HTTP/1.1, andDYNAMICalready behaves this way for cleartext.Validation
ProxyTestCase(11 tests) and theHttp2*connector tests pass.🤖 Generated with Claude Code