Skip to content

feat: add DisableHTTPFallback to respect explicit HTTP/1.1 configuration#529

Closed
hetbhatt2807 wants to merge 1 commit intoprojectdiscovery:mainfrom
hetbhatt2807:fix/disable-http-fallback
Closed

feat: add DisableHTTPFallback to respect explicit HTTP/1.1 configuration#529
hetbhatt2807 wants to merge 1 commit intoprojectdiscovery:mainfrom
hetbhatt2807:fix/disable-http-fallback

Conversation

@hetbhatt2807
Copy link

No description provided.

@neo-by-projectdiscovery-dev
Copy link

neo-by-projectdiscovery-dev bot commented Mar 4, 2026

Neo - PR Security Review

No security issues found

Highlights

  • Adds DisableHTTPFallback boolean field to Client struct to control automatic HTTP/1 → HTTP/2 protocol upgrade fallback
  • Modifies Do() method to check the flag before attempting HTTPClient2 fallback when HTTP/1.x client receives HTTP/2 responses
  • Fallback is triggered by specific Go stdlib error messages indicating protocol mismatch, not user-controllable input
Hardening Notes
  • Consider adding DisableHTTPFallback to the Options struct (lines 40-76 in client.go) alongside other configuration options, rather than as a direct Client field, for API consistency and easier configuration during client construction

Comment @pdneo help for available commands. · Open in Neo

Backoff Backoff

options Options
DisableHTTPFallback bool
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code should be aligned to the left (if you use vscode or cursor it should automatically fmt on file save)

if err != nil && stringsutil.ContainsAny(err.Error(), "net/http: HTTP/1.x transport connection broken: malformed HTTP version \"HTTP/2\"", "net/http: HTTP/1.x transport connection broken: malformed HTTP response") {
resp, err = c.HTTPClient2.Do(req.Request)
checkOK, checkErr = c.CheckRetry(req.Context(), resp, err)
if !c.DisableHTTPFallback &&
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe we can control this at package level with something like:

var ENABLE_HTTP2 = true

with default value to true, so that users can disable it via code. What do you think?

@Mzack9999
Copy link
Member

The underlying issue (httpx#2240) has been resolved at the httpx level — the HTTP/1.1 protocol preference is now correctly enforced without requiring changes to retryablehttp-go. Closing as the original bounty issue is already complete. Thanks for the contribution.

@Mzack9999 Mzack9999 closed this Mar 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants