Re: HTTP/3 CONNECT requests, body, and trailers

On Fri, Feb 06, 2026 at 10:54:34AM +1100, Martin Thomson wrote:
> On Fri, Feb 6, 2026, at 06:58, Lucas Pardue wrote:
> > Alex beat me to what I was going to say here. The proposed text could 
> > be wordsmithed more I guess. Still not convinced this is a huge spec 
> > problem though (the protocol-level requirements are correct IMO, just 
> > maybe not super obvious on first inspection but what is?)

Same reaction here :-)

> You are both right, of course.  This did seem editorial, but the 2xx/200
> question below might tip that further toward being technical.
> 
> Is it 2xx that has no response body, or is it only 200?  I don't know if we
> ever really decided that.

IMHO it's 200. At least I don't remember seeing an implementation
accepting any other 2xx to validate a CONNECT, though that would be
another interesting case to try to perform content smuggling through
intermediaries on HTTP/1.

> > A CONNECT request consists of a header block only and cannot contain a body
> > or trailers; similarly, a 200 response to a CONNECT requests consists of a
> > header block only.

This can make one think that there's nothing after the header block.
Probably we should say "a header block followed by data till the end
of the stream" ? I like to say that CONNECT establishes a tunnel, i.e.
it's opaque for the intermediary.

> >  Other responses to a CONNECT request are normal HTTP
> > responses and can contain a body (that can explain why a request failed,
> > for example).

Thus possibly even trailers for that one in this case.

Willy

Received on Friday, 6 February 2026 10:18:34 UTC