Re: Is the response header "Upgrade: h2" allowed when TLS is used?

> On 19 Apr 2016, at 17:05, Stefan Eissing <stefan.eissing@greenbytes.de> wrote:
> 
>> 
>> Am 19.04.2016 um 17:29 schrieb Cory Benfield <cory@lukasa.co.uk>:
>> 
>> 
>>> On 19 Apr 2016, at 16:16, Lucas Pardue <Lucas.Pardue@bbc.co.uk> wrote:
>>> 
>>> Stefan and Daniel point out that the server uses the Upgrade header to "advertise support" for h2. RFC 7230 Section 6.7 [5] states that the server MAY send the Upgrade header. It seems to me like Apache is technically compliant. On an https connection this information shouldn't be used to perform an HTTP upgrade to h2, since that is invalid (but a client issue not a server one). On an http connection the info could be used by the client e.g. they decide to negotiate an h2 session using ALPN.
>> 
>> I don’t think that’s really a good way to read this section of RFC 7230. The first sentence in this section is 'The "Upgrade" header field is intended to provide a simple mechanism for transitioning from HTTP/1.1 to some other protocol on the same connection.’. Note that phrase “on the same connection”. I’d argue, based on that, that the server-sent Upgrade header should only list protocols that the server is willing to upgrade to *on that connection*.
> 
> The mechanism is there and could be use. I do not know of a client which can though...
> 
> And rfc 7540, ch. 3.2 says: "A server MUST ignore an "h2" token in an Upgrade header field. Presence of a token with "h2" implies HTTP/2 over TLS, which is instead negotiated as described in Section 3.3."
> 
> Reading that, a server can never support this. So, we are in violation...rebels almost…

Heh, I missed that. With that note, then, I’d say that Apache should stop putting h2 in the Upgrade header on a TLS-using connection *unless* it believes that connection is for a HTTP-schemed URL, when it should put h2c.

Cory