aboutsummaryrefslogtreecommitdiff
path: root/src/net/http/server.go
AgeCommit message (Collapse)Author
9 daysnet/http: fix shadow var frameWeixie Cui
Change-Id: Ib03f65992b065e169fa6ccd08664336bec559c1d GitHub-Last-Rev: bd597d4325c713c53a9f22cb93892d90f393c6ac GitHub-Pull-Request: golang/go#78527 Reviewed-on: https://go-review.googlesource.com/c/go/+/762700 Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Florian Lehner <lehner.florian86@gmail.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com>
2026-03-31net/http: support passing Server Shutdown context to HTTP/3 implementationsNicholas S. Husin
Currently, when Server.Shutdown is called with a given context, an HTTP/3 server implementation does not have access to said context. This forces HTTP/3 server implementations to guess a reasonable fixed timeout when attempting to gracefully shutdown, which is not ideal. Therefore, add ShutdownContext method to http3ServerHandler to handle this. For #77440 Change-Id: Ib15b615f646fd08788981eb06f3a70606a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/761480 Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2026-03-24net/http: fix panic in ServeTLS on nil TLSConfigchressie
Change-Id: I9bc588128ec36bb3725d15e52400b76a94e5cb3a Reviewed-on: https://go-review.googlesource.com/c/go/+/758560 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com>
2026-03-23net/http: make ResponseWriter.ReadFrom respect declared Content-LengthNicholas S. Husin
Unlike ResponseWriter.Write, ResponseWriter.ReadFrom does not currently respect declared Content-Length header. As a result, it is possible for a server handler to inadvertently write more bytes for their response body than has been declared via Content-Length. These excess bytes are written to the wire, and could potentially be misinterpreted by a client as a separate response. That said, this is not a concern security-wise. This edge case can only be exercised by someone who has a relatively complete control of a server handler—by which point, worse things can be done with less effort. Regardless, this is still a bug. Therefore, make sure that ResponseWriter.ReadFrom respects declared Content-Length too for consistency. Fixes #78179 Change-Id: I469b064e43e49e467b907d23fc1ee879066569f0 Reviewed-on: https://go-review.googlesource.com/c/go/+/755701 Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Nicholas Husin <nsh@golang.org> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-12net/http: use net/http/internal/http2 rather than h2_bundle.goDamien Neil
Rework net/http/internal/http2 to use internally-defined types rather than net/http types (to avoid an import cycle). Remove h2_bundle.go, and replace it with calls into net/http/internal/http2 instead. For #67810 Change-Id: I56a1b28dbd0e302ab15a30f819dd46256a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751304 Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com>
2026-03-12net/http: move DetectContentType into net/http/internalDamien Neil
The http2 package needs access to DetectContentType, so move it into a common location. For #67810 Change-Id: Ibff3d57a4931106c2f69c5717c06bd5f6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/751701 Reviewed-by: Nicholas Husin <nsh@golang.org> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-03-04net/http: add basic unexported pluggable HTTP/3 supportNicholas S. Husin
Following #77440, this CL adds a basic support for plugging in an HTTP/3 implementation to net/http. As the proposal is not accepted yet, this CL does not add any exported symbols. Access to plug HTTP/3 support is locked behind net/http.protocolSetHTTP3, which can only be used via linkname by golang.org/x/net/internal/http3_test.protocolSetHTTP3. This will allow us to run our HTTP/3 implementation in x/net againts various tests in net/http to support development, without expanding the API surface for any users. Support for closeIdleConnectionser will be added separately in the future. For #77440 Change-Id: I6e3a0c2e9b329cef43e4682463ed5e2093d04256 Reviewed-on: https://go-review.googlesource.com/c/go/+/740120 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-22net/http: Add Server.DisableClientPriority fieldNicholas S. Husin
The DisableClientPriority field is currently still a no-op, and will only take effect once golang.org/x/net is bundled up into h2_bundle.go again. For #75500 Change-Id: I9e2135bed50b7f201aea93467e3f5f5f6c81cb1c Reviewed-on: https://go-review.googlesource.com/c/go/+/738620 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com>
2026-01-22net/http: use math/rand/v2 instead of math/rand1911860538
math/rand/v2 provides a more modern, performant, and secure random number API. Change-Id: Ic0c30ae40623508e3ed65c435be3c208704b5655 GitHub-Last-Rev: a8fa520b39cb5cc56042b74f6c40163bf8115247 GitHub-Pull-Request: golang/go#76433 Reviewed-on: https://go-review.googlesource.com/c/go/+/723680 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-11-21net/http: remove unused linknamesSean Liao
These were removed in: https://github.com/gobwas/ws/commit/8e2d520ba2966517f9c339e36dd89fd8a4460446 For #67401 Change-Id: I44898beb6fa3b6867b3d2164fc930724e143cf30 Reviewed-on: https://go-review.googlesource.com/c/go/+/721200 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http: preserve original path encoding in redirectsSean Liao
Fixes #70758 Change-Id: I9fc6fe98c194351557c6219513918b7593899bc1 Reviewed-on: https://go-review.googlesource.com/c/go/+/720821 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http: use HTTP 307 redirects in ServeMuxSean Liao
Clients receiving an HTTP 301 Moved Permanently may conservatively change the method of a POST request to GET. The newer HTTP 307 Temporary Redirect and 308 Permanent Redirect explicitly allows retrying POST requests after the redirect. These should be safe for ServeMux as this internal redirect is generated before user provided handlers are called. As ServeMux is making the redirect for the user without explicit direction, and clients may cache Permanent Redirects indefinitely, Temporary Redirect is used in case the user adds a handler for a path, that was previously redirected but no longer should. Fixes #50243 Fixes #60769 Change-Id: I6c0b735bab03bb7b50f05457b3b8a8ba813badb2 Reviewed-on: https://go-review.googlesource.com/c/go/+/720820 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-18Revert "net/http: do not discard body content when closing it within request ↵Nicholas S. Husin
handlers" This reverts commit cb0d9980f5721715ebb73dd2e580eaa11c2ddee2. Reason for revert: the old behavior seems to be relied on by current users, e.g. https://github.com/connectrpc/connect-go/blob/cb2e11fb88c9a61804043355a619c12d4a30a1a5/protocol_connect.go#L837. For #75933 Change-Id: I996280238e5c70a8d760a0b31e3a13c6a44b8616 Reviewed-on: https://go-review.googlesource.com/c/go/+/721761 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com>
2025-11-14net/http: do not discard body content when closing it within request handlersNicholas S. Husin
(*body).Close() internally tries to discard the content of a request body up to 256 KB. We rely on this behavior to allow connection re-use, by calling (*body).Close() when our request handler exits. Unfortunately, this causes an unfortunate side-effect where we would prematurely try to discard a body content when (*body).Close() is called from within a request handler. There should not be a good reason for (*body).Close() to do this when called from within a request handler. As such, this CL modifies (*body).Close() to not discard body contents when called from within a request handler. Note that when a request handler exits, it will still try to discard the body content for connection re-use. For #75933 Change-Id: I71d2431a540579184066dd35d3da49d6c85c3daf Reviewed-on: https://go-review.googlesource.com/c/go/+/720380 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-10-08net/http: update HTTP/2 documentation to reference new config featuresDamien Neil
Update the package docs to point users at the modern HTTP/2 configuration APIs. Mention in the TLSNextProto documentation that this field is superseded by the Protocols field for most user-facing purposes. Change-Id: I30cd9a85a27e1174338f0d6b887f98c28eac5b5d Reviewed-on: https://go-review.googlesource.com/c/go/+/709797 Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-09-15net/http: clarify panic conditions in Handle, HandleFunc, ↵Cole Garien
AddInsecureBypassPattern Add explicit mention that these methods panic on both pattern conflict and invalid syntax. Fixes #75226 Change-Id: If7dbfc44e1ec4624ab156f0e5d7e66cee2c2fef3 GitHub-Last-Rev: acc9a9c3338373f5a9376ff2eb1decd30bbee04d GitHub-Pull-Request: golang/go#75297 Reviewed-on: https://go-review.googlesource.com/c/go/+/701016 Reviewed-by: Michael Knyszek <mknyszek@google.com> Auto-Submit: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-08-31net/http: skip redirecting in ServeMux when URL path for CONNECT is emptyNicholas Husin
In 1.21 ServeMux, we had a special-case to skip redirection when a given path is empty for CONNECT requests: https://go.googlesource.com/go/+/refs/tags/go1.24.4/src/net/http/servemux121.go#205. This special case seems to not have been carried over to 1.22 ServeMux. This causes needless redirection, which this CL fixes. Fixes #74422 Change-Id: I3cc5b4d195ab0591a9139225b632cbe17f4290db Reviewed-on: https://go-review.googlesource.com/c/go/+/699915 Reviewed-by: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Sean Liao <sean@liao.dev> Reviewed-by: Damien Neil <dneil@google.com>
2025-07-28net/http: add proper panic messageyazdan
Change-Id: Ibfb330eaf24e004ddec60a5ca08cdc780235ad8c Reviewed-on: https://go-review.googlesource.com/c/go/+/688315 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <mark@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-05-23net/http: document that ServeMux.Handler can also synthetize a 405Filippo Valsorda
Also, fix a minor typo in ServeMux.Handle and ServeMux.HandleFunc. Change-Id: I6a6a46565719104cb8f2484daf0e39f35b55a078 Reviewed-on: https://go-review.googlesource.com/c/go/+/675835 Reviewed-by: David Chase <drchase@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-05-19net/http: clarify ServeMux.Handler behaviorJonathan Amsterdam
Explain that ServeMux.Handler doesn't populate the request with matches. Fixes #69623. Change-Id: If625b3f8e8f4e54b05e1d9a86e8c471045e77763 Reviewed-on: https://go-review.googlesource.com/c/go/+/674095 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Chressie Himpel <chressie@google.com> Reviewed-by: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-05-19net/http: fix ServeMux.Handler on trailing-slash redirectJonathan Amsterdam
When a match involves a trailing-slash redirect, ServeMux.Handler now returns the pattern that matched. Fixes #73688. Change-Id: I682d9cc9a3628bed8bf21139b98369ffa6c53792 Reviewed-on: https://go-review.googlesource.com/c/go/+/673815 Reviewed-by: Filippo Valsorda <filippo@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-05-12net/http: add missing ServeTLS on the comment of http.Server.Shutdownt-katsumura
A sentinel error http.ErrServerClosed is returned after Server.Shutdown and Server.Close but it is not documented on the Server.Shutdown while other methods such as Server.Serve are documented on it. Change-Id: Id82886d9d6a1474a514d62e9169b35f3579a9eee Reviewed-on: https://go-review.googlesource.com/c/go/+/671695 Reviewed-by: Cherry Mui <cherryyz@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Sean Liao <sean@liao.dev> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Sean Liao <sean@liao.dev>
2025-04-16net/http: set Request.TLS when net.Conn implements ConnectionStateWeidi Deng
Fixes #56104 Change-Id: I8fbbb00379e51323e2782144070cbcad650eb6f1 GitHub-Last-Rev: 62d7a8064e4f2173f0d8e02ed91a7e8de7f13fca GitHub-Pull-Request: golang/go#56110 Reviewed-on: https://go-review.googlesource.com/c/go/+/440795 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2025-04-09net/http: reduce memory usage when hijackingJakob Ackermann
Previously, Hijack allocated a new write buffer and the existing connection write buffer used an extra 4KiB of memory until the handler finished and the "conn" was garbage collected. Now, hijack re-uses the existing write buffer and re-attaches it to the raw connection to avoid referencing the net/http "conn" after returning. After a handler that hijacked exited, the "conn" reference in "connReader" will now be unset. This allows all of the "conn", "response" and "Request" to get garbage collected. Overall, this is reducing the memory usage by 43% or 6.7KiB per hijacked connection (see BenchmarkServerHijackMemoryUsage in an earlier revision of the CL). CloseNotify will continue to work _before_ the handler has exited (i.e. while the "conn" is still referenced in "connReader"). This aligns with the documentation of CloseNotifier: > After the Handler has returned, there is no guarantee that the channel > receives a value. goos: linux goarch: amd64 pkg: net/http cpu: Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz │ before │ after │ │ sec/op │ sec/op vs base │ ServerHijack-8 42.59µ ± 8% 39.47µ ± 16% ~ (p=0.481 n=10) │ before │ after │ │ B/op │ B/op vs base │ ServerHijack-8 16.12Ki ± 0% 12.06Ki ± 0% -25.16% (p=0.000 n=10) │ before │ after │ │ allocs/op │ allocs/op vs base │ ServerHijack-8 51.00 ± 0% 49.00 ± 0% -3.92% (p=0.000 n=10) Change-Id: I20a37ee314ed0d47463a4657d712154e78e48138 GitHub-Last-Rev: 80f09dfa273035f53cdd72845e5c5fb129c3e230 GitHub-Pull-Request: golang/go#70756 Reviewed-on: https://go-review.googlesource.com/c/go/+/634855 Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Sean Liao <sean@liao.dev>
2025-03-11net/http: document Redirect behavior for non-ASCII charactersIan Lance Taylor
For #4385 For #72745 Change-Id: Ibd54fc03467eb948001299001bb2e2529512a7c0 Reviewed-on: https://go-review.googlesource.com/c/go/+/656135 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-03-04net/http: don't modify caller's tls.Config.NextProtosDamien Neil
Clone the input slice before adjusting NextProtos to add or remove "http/1.1" and "h2" entries, so as not to modify a slice that the caller might be using. (We clone the tls.Config that contains the slice, but that's a shallow clone.) Fixes #72100 Change-Id: I9f228b8fb6f6f2ca5023179ec114929c002dbda9 Reviewed-on: https://go-review.googlesource.com/c/go/+/654875 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-03-04net/http: check server shutting down before processing the requestwineandchord
The root cause of issue #65802 is a small race condition that occurs between two events: 1. During the HTTP server shutdown, a connection in an idle state is identified and closed. 2. The connection, although idle, has just finished reading a complete request before being closed and hasn't yet updated its state to active. In this scenario, despite the connection being closed, the request continues to be processed. This not only wastes server resources but also prevents the client request from being retried. Fixes #65802 Change-Id: Ic22abb4497be04f6c84dff059df00f2c319d8652 GitHub-Last-Rev: 426099a3e75f51b80f8ca866938f31417d75ff89 GitHub-Pull-Request: golang/go#65805 Reviewed-on: https://go-review.googlesource.com/c/go/+/565277 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Carlos Amedee <carlos@golang.org> Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Sean Liao <sean@liao.dev>
2025-03-03net/http: allocate CloseNotifier channel lazilyJakob Ackermann
The CloseNotifier interface is deprecated. We can defer allocating the backing channel until the first use of CloseNotifier. goos: linux goarch: amd64 pkg: net/http cpu: Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz                    │   before    │               after                │                    │   sec/op    │   sec/op     vs base               │ Server-8             160.8µ ± 2%   160.1µ ± 1%       ~ (p=0.353 n=10) CloseNotifier/h1-8   222.1µ ± 4%   226.4µ ± 7%       ~ (p=0.143 n=10) geomean              189.0µ        190.4µ       +0.75%                    │    before    │                after                │                    │     B/op     │     B/op      vs base               │ Server-8             2.292Ki ± 0%   2.199Ki ± 0%  -4.07% (p=0.000 n=10) CloseNotifier/h1-8   3.224Ki ± 0%   3.241Ki ± 0%  +0.51% (p=0.000 n=10) geomean              2.718Ki        2.669Ki       -1.80%                    │   before   │                after                │                    │ allocs/op  │ allocs/op   vs base                 │ Server-8             21.00 ± 0%   20.00 ± 0%  -4.76% (p=0.000 n=10) CloseNotifier/h1-8   50.00 ± 0%   50.00 ± 0%       ~ (p=1.000 n=10) ¹ geomean              32.40        31.62       -2.41% ¹ all samples are equal Change-Id: I3f35d56b8356fb660589b7708a023e4480f32067 GitHub-Last-Rev: c75696b9b8498ae03a4ad9527b9b7c8337415456 GitHub-Pull-Request: golang/go#71163 Reviewed-on: https://go-review.googlesource.com/c/go/+/640598 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-02-10net/http: use standard time formatting methodsTom Thorogood
time.Time has had an AppendFormat method since go1.5 so there's no need to carry around a custom implementation. Change-Id: I8e7e5a9ac34e8bf251f5d70555405777ce4e22a8 Reviewed-on: https://go-review.googlesource.com/c/go/+/647955 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Ian Lance Taylor <iant@golang.org>
2025-02-04net: use strings.SplitSeq and bytes.SplitSeqapocelipes
Replace `for _, s := range {strings, bytes}.Split(v, sep)` with `for s := range {strings, bytes}.SplitSeq(v, sep)`, to simplify the code and reduce some memory allocations. Change-Id: Idead4de1e3928fc75cc5ba8caeff85542f1243d5 GitHub-Last-Rev: 5fb196a073e7583b23b1ebb446d6c067580ed63a GitHub-Pull-Request: golang/go#71554 Reviewed-on: https://go-review.googlesource.com/c/go/+/646216 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-11-21net/http: add support for unencrypted HTTP/2Damien Neil
Add an UnencryptedHTTP2 protocol value. Both Server and Transport implement "HTTP/2 with prior knowledge" as described in RFC 9113, section 3.3. Neither supports the deprecated HTTP/2 upgrade mechanism (RFC 7540, section 3.2 "h2c"). For Server, UnencryptedHTTP2 controls whether the server will accept HTTP/2 connections on unencrypted ports. When enabled, the server checks new connections for the HTTP/2 preface and routes them appropriately. For Transport, enabling UnencryptedHTTP2 and disabling HTTP1 causes http:// requests to be made over unencrypted HTTP/2 connections. For #67816 Change-Id: I2763c4cdec1c2bc6bb8157edb93b94377de8a59b Reviewed-on: https://go-review.googlesource.com/c/go/+/622976 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Keith Randall <khr@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2024-11-05net/http: add Protocols field to Server and TransportDamien Neil
Support configuring which HTTP version(s) a server or client use via an explicit set of protocols. The Protocols field takes precedence over TLSNextProto and ForceAttemptHTTP2. Fixes #67814 Change-Id: I09ece88f78ad4d98ca1f213157b5f62ae11e063f Reviewed-on: https://go-review.googlesource.com/c/go/+/607496 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2024-10-31net/http: clarify ServeMux path sanitizationSean Liao
For #70130 Change-Id: Idd7ca3d11b78887709b83dd5c868de9cc506ecff Reviewed-on: https://go-review.googlesource.com/c/go/+/623835 Reviewed-by: Carlos Amedee <carlos@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2024-10-02src/net/http: remove ServeMux.patternsJonathan Amsterdam
Remove an unexported field from ServeMux that was there only to support some Google-internal packages. It is no longer needed. Change-Id: I6a4d542c6c016f5a9f3d24d0c73f6ddd44c9562e Reviewed-on: https://go-review.googlesource.com/c/go/+/616355 Reviewed-by: Chressie Himpel <chressie@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-09-13net/http: make use of maps.CopyJes Cok
Change-Id: If8e02760fe1fb095ecebc306fd98662a51a1f66f GitHub-Last-Rev: 7b8099f1fed04271c121cdde1c3abd8822955368 GitHub-Pull-Request: golang/go#69426 Reviewed-on: https://go-review.googlesource.com/c/go/+/612736 Reviewed-by: Tim King <taking@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com>
2024-08-29net/http: add HTTP2ConfigDamien Neil
Add a field to Server and Transport containing HTTP/2 configuration parameters. This field will have no effect until golang.org/x/net/http2 is updated to make use of it, and h2_bundle.go is updated with the new http2 package. For #67813 Change-Id: I81d7f8e9ddea78f9666383983aec43e3884c13ed Reviewed-on: https://go-review.googlesource.com/c/go/+/602175 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2024-08-13net/http: rename server receiver for consistencywineandchord
"receiver name `srv` should be consistent with the previous receiver name `s` for Server" according to go-lint. Change-Id: I3071ae30b7c1375999e5a599a0eee7b88494f17e GitHub-Last-Rev: 093c7679b1919f364ed542904203d22ed2048313 GitHub-Pull-Request: golang/go#65787 Reviewed-on: https://go-review.googlesource.com/c/go/+/565175 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Carlos Amedee <carlos@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2024-07-29net/http: don't write HEAD response body in ResponseWriter.ReadFromDamien Neil
Responses to HEAD requests don't have a body. The ResponseWriter automatically discards writes to the response body when responding to a HEAD request. ResponseWriter.ReadFrom was failing to discard writes under some circumstances; fix it to do so. Fixes #68609 Change-Id: I912f6b2b2a535df28ae37b875fcf15b10da1af2b Reviewed-on: https://go-review.googlesource.com/c/go/+/601475 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2024-06-28net/http: avoid appending an existing trailing slash to path againJes Cok
This CL is similar to CL 562557, and it takes over CL 594175. While here, unrelatedly remove mapKeys function, use slices.Sorted(maps.Keys(ms)) to simplify code. Fixes #67657 Change-Id: Id8b99216f87a6dcfd6d5fa61407b515324c79112 Reviewed-on: https://go-review.googlesource.com/c/go/+/594737 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> Reviewed-by: Joedian Reid <joedian@google.com>
2024-06-18net/http: keep Content-Encoding in Error, add GODEBUG for ServeContentDamien Neil
This reverts the changes to Error from CL 571995, and adds a GODEBUG controlling the changes to ServeContent/ServeFile/ServeFS. The change to remove the Content-Encoding header when serving an error breaks middleware which sets Content-Encoding: gzip and wraps a ResponseWriter in one which compresses the response body. This middleware already breaks when ServeContent handles a Range request. Correct uses of ServeContent which serve pre-compressed content with a Content-Encoding: gzip header break if we don't remove that header when serving errors. Therefore, we keep the change to ServeContent/ ServeFile/ServeFS, but we add the ability to disable the new behavior by setting GODEBUG=httpservecontentkeepheaders=1. We revert the change to Error, because users who don't want to include a Content-Encoding header in errors can simply remove the header themselves, or not add it in the first place. Fixes #66343 Change-Id: Ic19a24b73624a5ac1a258ed7a8fe7d9bf86c6a38 Reviewed-on: https://go-review.googlesource.com/c/go/+/593157 Reviewed-by: Russ Cox <rsc@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-06-07net/http: check GetConfigForClient in server.ServeTLSChance Zibolski
Just like for tls.Config.GetCertificate the http.Server.ServeTLS method should be checking tls.Config.GetConfigForClient before trying top open the specified certFile/keyFile. This was previously fixed for crypto/tls when using tls.Listen in CL205059, but the same change for net/http was missed. I've added a comment src/crypto/tls/tls.go in the relevant section in the hope that any future changes of a similar nature consider will consider updating net/http as needed as well. Change-Id: I312303bc497d92aa2f4627fe2620c70779cbcc99 GitHub-Last-Rev: 6ed29a900816a13690a9f3e26476d9bc1055a6f7 GitHub-Pull-Request: golang/go#66795 Reviewed-on: https://go-review.googlesource.com/c/go/+/578396 Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2024-06-06net/http: send body or close connection on expect-100-continue requestsDamien Neil
When sending a request with an "Expect: 100-continue" header, we must send the request body before sending any further requests on the connection. When receiving a non-1xx response to an "Expect: 100-continue" request, send the request body if the connection isn't being closed after processing the response. In other words, if either the request or response contains a "Connection: close" header, then skip sending the request body (because the connection will not be used for further requests), but otherwise send it. Correct a comment on the server-side Expect: 100-continue handling that implied sending the request body is optional. It isn't. For #67555 Change-Id: Ia2f12091bee697771087f32ac347509ec5922d54 Reviewed-on: https://go-review.googlesource.com/c/go/+/591255 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2024-06-05net/http: use default HTTP/2 frame schedulerDamien Neil
Use the default frame scheduler (currently round-robin) rather than overriding the default with the priority scheduler. The priority scheduler is slow, known buggy, and implements a deprecated stream prioritization mechanism. The default changed in x/net about a year ago, but we missed that net/http is overriding that default. Fixes #67706 Change-Id: I6d76dd0cc8c55eb5dec5cd7d25a5084877e8e8d9 Reviewed-on: https://go-review.googlesource.com/c/go/+/590796 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> Auto-Submit: Damien Neil <dneil@google.com>
2024-05-29all: document legacy //go:linkname for final round of modulesRuss Cox
Add linknames for most modules with ≥50 dependents. Add linknames for a few other modules that we know are important but are below 50. Remove linknames from badlinkname.go that do not merit inclusion (very small number of dependents). We can add them back later if the need arises. Fixes #67401. (For now.) Change-Id: I1e49fec0292265256044d64b1841d366c4106002 Reviewed-on: https://go-review.googlesource.com/c/go/+/587756 Auto-Submit: Russ Cox <rsc@golang.org> TryBot-Bypass: Russ Cox <rsc@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com>
2024-05-16net/http: add Pattern field in Request to return matched pattern infoChen.Zhidong
Fixes #66405 Change-Id: Icd80944b6ca081aa7addd4fb85d2b3c29b6c9542 GitHub-Last-Rev: c6e32742c4b733230c82627571b423de45997c24 GitHub-Pull-Request: golang/go#66618 Reviewed-on: https://go-review.googlesource.com/c/go/+/574997 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-05-14net/http: avoid panic when writing 100-continue after handler doneDamien Neil
When a request contains an "Expect: 100-continue" header, the first read from the request body causes the server to write a 100-continue status. This write caused a panic when performed after the server handler has exited. Disable the write when cleaning up after a handler exits. This also fixes a bug where an implicit 100-continue could be sent after a call to WriteHeader has sent a non-1xx header. This change drops tracking of whether we've written a 100-continue or not in response.wroteContinue. This tracking was used to determine whether we should consume the remaining request body in chunkWriter.writeHeader, but the discard-the-body path was only taken when the body was already consumed. (If the body is not consumed, we set closeAfterReply, and we don't consume the remaining body when closeAfterReply is set. If the body is consumed, then we may attempt to discard the remaining body, but there is obviously no body remaining.) Fixes #53808 Change-Id: I3542df26ad6cdfe93b50a45ae2d6e7ef031e46fa Reviewed-on: https://go-review.googlesource.com/c/go/+/585395 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Jonathan Amsterdam <jba@google.com>
2024-05-09net/http: remove misleading response headers on errorRuss Cox
This is a reapply of CL 544019 and CL 569815, but with less aggressive semantics as discussed in proposal #66343. Error deletes Content-Encoding, since it is writing the response and any preset encoding may not be correct. On the error-serving path in ServeContent/ServeFile/ServeFS, these functions delete additional headers: Etag, Last-Modified, and Cache-Control. The caller may have set these intending them for the success response, and they may well not be correct for error responses. Fixes #50905. Fixes #66343. Change-Id: I873d33edde1805990ca16d85ea8d7735b7448626 Reviewed-on: https://go-review.googlesource.com/c/go/+/571995 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-04-30http: fix some comments typo in server.goThe Backend Grip
Change-Id: I826412175876a84ab978aba9418be28593484fba GitHub-Last-Rev: d35753c7e027ce4ca1fe63d96985de9e90bf813b GitHub-Pull-Request: golang/go#67112 Reviewed-on: https://go-review.googlesource.com/c/go/+/582435 Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2024-03-26net/http: fix typo in log messageDamien Neil
Change-Id: I399c65b44706cf5407099e867de27b3acdaf4825 Reviewed-on: https://go-review.googlesource.com/c/go/+/574235 Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2024-03-25net/http: also log TLS errors which look like HTTP sent to an HTTPS portDamien Neil
We log TLS handshake errors in general, but currently do not log errors when the first TLS record looks like an attempt to send HTTP to an HTTPS port. There doesn't seem to be any principled reason to log the one and not the other, so just log all TLS handshake errors. Fixes #66501 Change-Id: I5d78a754d054c220be935513448515721fa387a6 Reviewed-on: https://go-review.googlesource.com/c/go/+/573979 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Jonathan Amsterdam <jba@google.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Auto-Submit: Emmanuel Odeke <emmanuel@orijtech.com> Run-TryBot: Emmanuel Odeke <emmanuel@orijtech.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 12:03:16 +0000