Skip to content

fix(tls): serve HTTP/2 directly and normalize response headers - #20

Merged
Antruly merged 1 commit into
mainfrom
fix/tls-h2-headers
Oct 27, 2026
Merged

Antruly merged 1 commit into
mainfrom
fix/tls-h2-headers

Conversation

@Antruly

@Antruly Antruly commented Oct 27, 2026

Copy link
Copy Markdown
Owner

Fixes the direct TLS hang: libuvcpp's HTTP/2 response builder rejects uppercase header names, and uvscope set Cache-Control, X-Frame-Options, Content-Security-Policy, etc. in mixed case. The h2 stream was dropped after a successful ALPN h2 handshake, so browsers waited forever.

Changes

  • Lowercase every response header name in the application, auth and preview/download response paths.
  • Lowercase custom request header names in the HTTP probe (h2 request headers have the same rule).
  • Keep the built-in TLS listener on HTTP/2 with an HTTP/1.1 fallback.
  • Add scripts/tls-smoke.sh, which starts a self-signed TLS daemon and asserts HTTP/2 200, ALPN h2 and HTTP/1.1 fallback; run it in Linux CI and the release pipeline.
  • Document that the libuvcpp webapp still cannot serve HTTP/3 responses (TCP-bound response path); h3 needs nginx 1.25+/Cloudflare or the HTTP/3 probe client.

Verification

  • ./scripts/build.sh
  • --self-check 0 failures
  • bash ./scripts/tls-smoke.sh ./build/uvscope 18830 → HTTP/2 + h1 fallback
  • Full smoke-test.sh suite
  • Direct TLS HTTP/2 verified against a libuvcpp 1.8.8 build (UI, setup, authenticated API, WebSocket upgrade over h1)

HTTP/2 requires lowercase header field names. uvscope set mixed-case
Cache-Control, X-Frame-Options and similar response headers; libuvcpp's h2
response builder rejected the header block and dropped the stream, so
browsers hung after a successful h2 handshake. Lowercase every response
header, lowercase custom HTTP-probe request header names, and keep the
built-in TLS listener on HTTP/2 with an HTTP/1.1 fallback.

- add scripts/tls-smoke.sh (HTTP/2, ALPN h2, HTTP/1.1 fallback)
- run it in Linux CI and the release pipeline
- document that HTTP/3 is not yet served by the libuvcpp webapp: h3 works
  below the webapp, but the webapp's response path is TCP-bound and drops
  h3 responses. Use an h3-capable edge (nginx 1.25+/Cloudflare) or the
  HTTP/3 probe client until the upstream path is fixed.

Verified: build, self-check, full smoke suite and tls-smoke; direct TLS
HTTP/2 on a libuvcpp 1.8.8 server build.
@Antruly
Antruly merged commit 55b57ac into main Oct 27, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant