Skip to content

fix: bump fhttp to include HTTP/2 POST body fix#416

Open
akagomez wants to merge 2 commits intoDanny-Dasilva:mainfrom
akagomez:fix/bump-fhttp-http2-post-body
Open

fix: bump fhttp to include HTTP/2 POST body fix#416
akagomez wants to merge 2 commits intoDanny-Dasilva:mainfrom
akagomez:fix/bump-fhttp-http2-post-body

Conversation

@akagomez
Copy link
Copy Markdown

@akagomez akagomez commented Mar 24, 2026

Summary

Updates fhttp from v0.0.0-20240217 to v0.0.0-20260106 to fix HTTP/2 POST/PUT/PATCH body transmission for Chrome and Firefox navigators.

Problem

AutoUpdate() in fhttp/http2/transport.go sets HeaderTableSize and MaxHeaderListSize for Chrome/Firefox navigators but does not set InitialWindowSize. This leaves it at 0, so cc.flow.add(int32(0)) gives the connection-level flow window zero capacity. All body writes block in awaitFlowControl() and DATA frames are never sent.

The default navigator case correctly sets InitialWindowSize = initialWindowSize. The fix adds the same assignment to the Chrome and Firefox cases.

Servers with strict HTTP/2 flow control send RST_STREAM CANCEL when the body never arrives. Lenient servers happen to tolerate the missing flow control.

Reproduction

This PR has two commits for easy verification:

Commit 1 (e3f5b38) adds tests only — no fix. They fail:

git checkout e3f5b38
npm install
npx jest tests/http2-post-body.test.ts --forceExit
# Result: 4 failed (expected 200, received 408)

Commit 2 (083eb59) bumps fhttp — tests pass:

git checkout 083eb59
cd src && go build -o ../dist/index-mac-arm64 . && cd ..
npx jest tests/http2-post-body.test.ts --forceExit
# Result: 4 passed

Tests

The tests start a local HTTPS server with strict HTTP/2 settings (initialWindowSize: 16384) and verify form-encoded POST, JSON POST, PUT, and PATCH bodies are transmitted correctly.

Changes

  • tests/http2-post-body.test.ts — new test file
  • cycletls/go.mod — bump fhttp
  • src/go.mod — same (indirect)
  • go.sum files updated

All existing Go tests pass with the updated dependency.

@akagomez akagomez marked this pull request as draft March 24, 2026 14:19
@akagomez akagomez force-pushed the fix/bump-fhttp-http2-post-body branch from f889c4b to 76f5da4 Compare March 24, 2026 15:01
Adds tests that verify POST/PUT/PATCH body transmission over HTTP/2
to a server with strict flow control settings (initialWindowSize: 16384).

These tests FAIL on the current codebase because AutoUpdate() in
fhttp does not set InitialWindowSize for Chrome/Firefox navigators,
causing connection-level flow control to start at 0. All body writes
block in awaitFlowControl() and DATA frames are never sent.

To reproduce:
  npm install
  npx jest tests/http2-post-body.test.ts --forceExit

Expected: 4 failed (expected 200, received 408)
Updates fhttp from v0.0.0-20240217 to v0.0.0-20260106 which adds the
missing InitialWindowSize assignment in AutoUpdate() for Chrome and
Firefox navigators.

This fixes the 4 failing tests from the previous commit.

To verify:
  npm install
  cd src && go build -o ../dist/index-mac-arm64 . && cd ..
  npx jest tests/http2-post-body.test.ts --forceExit

Expected: 4 passed
@akagomez akagomez force-pushed the fix/bump-fhttp-http2-post-body branch from 76f5da4 to 083eb59 Compare March 24, 2026 15:11
@akagomez akagomez marked this pull request as ready for review March 24, 2026 15:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant