Clarify HTTP/2 and HTTP/3 pseudo-headers interaction with ASGI
See original GitHub issueIn addition to “normal” HTTP headers, HTTP/2 and HTTP/3 use pseudo-headers starting with “:”, some of which have natural mappings to ASGI scope variables :
- :method: => this maps to
scope["method"]
- :path: => this maps to
scope["raw_path"]
- :scheme: => this maps to
scope["scheme"]
A more problematic pseudo-header is :authority which is the equivalent of HTTP/1.1’s Host
header.
It would be good to clarify in the ASGI specs:
-
how should the :authority pseudo-header be conveyed by the server to the ASGI app: should servers append a synthetic
Host
header? -
my feeling is that pseudo-headers should be purge from what is passed into scope[“headers”], do we want to specify this in the specs?
Another interesting pseudo-header is the :protocol pseudo-header which is used to handshake WebSockets over HTTP/2, and very likely also over HTTP/3.
Issue Analytics
- State:
- Created 4 years ago
- Comments:7 (7 by maintainers)
Top Results From Across the Web
ASGI Documentation
Pseudo headers. (present in HTTP/2 and HTTP/3) must not be present. The ASGI server should then attempt to send a server push (or...
Read more >Introduction to HTTP/2 - web.dev
HTTP/2 (or h2) is a binary protocol that brings push, multiplexing streams and frame control to the web.
Read more >RFC 7540 - Hypertext Transfer Protocol Version 2 (HTTP/2)
A client that makes a request to an "https" URI uses TLS [TLS12] with the application-layer protocol negotiation (ALPN) extension [TLS-ALPN] . HTTP/2...
Read more >HTTP/2: The Sequel is Always Worse | PortSwigger Research
HTTP/2 replaces the request line with a series of pseudo-headers. ... :scheme - The request scheme, typically 'http' or 'https'
Read more >What is the purpose of http2 pseudo-headers :authority
The HTTP/2 :method pseudo-header is equivalent to the HTTP/1.1 request method (the first token of the HTTP/1.1 request line).
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
I’ve long held the position that ASGI’s position is not to be a low-level HTTP library but a useful abstraction that works for 95% of apps, and so given that I agree we should ban pseudo-headers from going through and we should synthesise a Host header.
See #123.