aboutsummaryrefslogtreecommitdiff
path: root/src/net/http
AgeCommit message (Collapse)Author
2026-02-03all: prealloc slice with possible minimum capabilitiesShulhan
2026-02-02net/http: try to drain response body upon closing for better connection re-useNicholas S. Husin
Currently, we have a rather inconsistent behavior in terms of whether a connection can be re-used or not when an HTTP body is not read to completion: - In HTTP/2, not reading bodies to completion is not an issue, since a new HTTP/2 stream can be created on the same TCP connection. - In HTTP/1 server, we discard up to 256 KiB of unconsumed request body, to potentially allow re-use. - In HTTP/1 client, we do not do anything, and fail to re-use a TCP connection if there are any unconsumed response body at all. This has led to some confusion. For example, some users have mistakenly discarded response body for HTTP/2 when doing so is not needed. Manually discarding response body can also be disadvantageous if the body is excessively large or is a never-ending stream. To solve this issue, this CL makes it so that closing a response body will cause any remaining content to be drained, up to a limit of 256 KiB or 50 milliseconds, whichever one is reached first. This allows better connection re-use for HTTP/1, and most users can now avoid having to manually drain their response body. For #77370 Change-Id: I71e1227fc9cf5f901362c8e234320817f6b0be24 Reviewed-on: https://go-review.googlesource.com/c/go/+/737720 Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com>
2026-01-23all: update vendored dependenciesNicholas S. Husin
This CL does the following: 1. Bundles up golang.org/x/net/internal/httpsfv since h2_bundle.go now relies on it. 2. Modifies h2_bundle.go import mapping to account for httpsfv package. 3. Updates all vendored dependencies using golang.org/x/build/cmd/updatestd. For #75500 Change-Id: Ia2f41ad606092fe20b62f946266190502b146977 Reviewed-on: https://go-review.googlesource.com/c/go/+/738621 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2026-01-22net/http: Add Server.DisableClientPriority fieldNicholas S. Husin
The DisableClientPriority field is currently still a no-op, and will only take effect once golang.org/x/net is bundled up into h2_bundle.go again. For #75500 Change-Id: I9e2135bed50b7f201aea93467e3f5f5f6c81cb1c Reviewed-on: https://go-review.googlesource.com/c/go/+/738620 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com>
2026-01-22net/http: use math/rand/v2 instead of math/rand1911860538
math/rand/v2 provides a more modern, performant, and secure random number API. Change-Id: Ic0c30ae40623508e3ed65c435be3c208704b5655 GitHub-Last-Rev: a8fa520b39cb5cc56042b74f6c40163bf8115247 GitHub-Pull-Request: golang/go#76433 Reviewed-on: https://go-review.googlesource.com/c/go/+/723680 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-12-05all: fix some comment issuescuishuang
Change-Id: I5dec35b1432705b3a52859c38e758220282226af Reviewed-on: https://go-review.googlesource.com/c/go/+/726700 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Sean Liao <sean@liao.dev> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2025-12-01net/http: deflake TestClientConnReserveAndConsumeDamien Neil
This test includes an assertion that a client conn's state hook is called exactly once, but some of the test cases can result in two events occurring: A request completes and a connection closes. Change the assertion to just check that the hook is called at least once. Fixes #76480 Change-Id: Ie1438581b072b10623eb3d5fe443294a639c9853 Reviewed-on: https://go-review.googlesource.com/c/go/+/725601 Commit-Queue: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> TryBot-Bypass: Damien Neil <dneil@google.com>
2025-11-24net/http: add Transport.NewClientConnDamien Neil
For #75772 Change-Id: Iad7607b40636bab1faf8653455e92e9700309003 Reviewed-on: https://go-review.googlesource.com/c/go/+/722223 Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-24all: update to x/net@bff14c52567061031b9761881907c39e24792736Damien Neil
This brings in CL 722200 which adds necessary HTTP/2 support for net/http.Transport.NewClientConn. For #75772 Change-Id: I5489232401096982ed21002f293dd0f87fe2fba6 Reviewed-on: https://go-review.googlesource.com/c/go/+/723901 Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com>
2025-11-21net/http: remove unused linknamesSean Liao
These were removed in: https://github.com/gobwas/ws/commit/8e2d520ba2966517f9c339e36dd89fd8a4460446 For #67401 Change-Id: I44898beb6fa3b6867b3d2164fc930724e143cf30 Reviewed-on: https://go-review.googlesource.com/c/go/+/721200 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http: populate Response.Request when using NewFileTransportSean Liao
Fixes #51562 Change-Id: Ia6fe4728b1e3e0cf3a6462be99c1044260cadf31 Reviewed-on: https://go-review.googlesource.com/c/go/+/720822 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http: preserve original path encoding in redirectsSean Liao
Fixes #70758 Change-Id: I9fc6fe98c194351557c6219513918b7593899bc1 Reviewed-on: https://go-review.googlesource.com/c/go/+/720821 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http: use HTTP 307 redirects in ServeMuxSean Liao
Clients receiving an HTTP 301 Moved Permanently may conservatively change the method of a POST request to GET. The newer HTTP 307 Temporary Redirect and 308 Permanent Redirect explicitly allows retrying POST requests after the redirect. These should be safe for ServeMux as this internal redirect is generated before user provided handlers are called. As ServeMux is making the redirect for the user without explicit direction, and clients may cache Permanent Redirects indefinitely, Temporary Redirect is used in case the user adds a handler for a path, that was previously redirected but no longer should. Fixes #50243 Fixes #60769 Change-Id: I6c0b735bab03bb7b50f05457b3b8a8ba813badb2 Reviewed-on: https://go-review.googlesource.com/c/go/+/720820 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http: update Response.Request.URL after redirects on GOOS=jsSean Liao
Fixes #71346 Change-Id: Id4053626e621faf50bb88a10ca0d540f393c8e01 Reviewed-on: https://go-review.googlesource.com/c/go/+/720860 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-11-21net/http/cookiejar: treat localhost as secure originSean Liao
For development purposes, browsers treat localhost as a secure origin regardless of protocol. Fixes #60997 https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies#restrict_access_to_cookies https://bugzilla.mozilla.org/show_bug.cgi?id=1618113 https://issues.chromium.org/issues/40120372 Change-Id: I6d31df4e055f2872c4b93571c53ae5160923852b Reviewed-on: https://go-review.googlesource.com/c/go/+/717860 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Mark Freeman <markfreeman@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-11-21net/http: fix typo in Transport docsVictor
Change-Id: Ifeb8d6d2e3fd4c8b0e27da62bec5cf28fe71db34 GitHub-Last-Rev: 5760fb106f58bf77817b9813f029d47be4ca7e3b GitHub-Pull-Request: golang/go#76316 Reviewed-on: https://go-review.googlesource.com/c/go/+/720800 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Mark Freeman <markfreeman@google.com> Auto-Submit: Sean Liao <sean@liao.dev> Reviewed-by: Sean Liao <sean@liao.dev>
2025-11-20net/http/httputil: wrap ReverseProxy's outbound request body so Close is a noopNicholas S. Husin
Within ReverseProxy, we are currently sending a clone of our inbound request (from client) as our outbound request (to upstream). However, the clone of the request has a shallow copy of the request body. As a result, when the outbound request body is closed, the inbound request body (i.e. the outbound request body of the client) will also be closed. This causes an unfortunate effect where we would infinitely hang when a client sends a request with a 100-continue header via a ReverseProxy, but the ReverseProxy fails to make a connection to the upstream server. When this happens, the ReverseProxy's outbound request body would be closed, which in turns also closes the client's request body. Internally, when we close a request body, we would try to consume and discard the content. Since the client has yet to actually send the body content (due to 100-continue header) though, an infinite hang occurs. To prevent this, we make sure that closing an outbound request body from a ReverseProxy is a noop. For #75933 Change-Id: I52dc7247f689f35a6e93d1f32b2d003d90e9d2c6 Reviewed-on: https://go-review.googlesource.com/c/go/+/722160 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-20net/http: drop unused "broken" field from persistConnDamien Neil
Change-Id: Ic65cf98c090c73299b5e88e642e91139315d8e52 Reviewed-on: https://go-review.googlesource.com/c/go/+/722221 Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
2025-11-20net/http: correctly close fake net.ConnsDamien Neil
Fix an inverted test in fakeNetConn.Close that caused closing a connection to not break the other half of the connection. Change-Id: I4e53f78402f8e503c749d57f294a4524abdccfb5 Reviewed-on: https://go-review.googlesource.com/c/go/+/722220 Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> Auto-Submit: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-18Revert "net/http: do not discard body content when closing it within request ↵Nicholas S. Husin
handlers" This reverts commit cb0d9980f5721715ebb73dd2e580eaa11c2ddee2. Reason for revert: the old behavior seems to be relied on by current users, e.g. https://github.com/connectrpc/connect-go/blob/cb2e11fb88c9a61804043355a619c12d4a30a1a5/protocol_connect.go#L837. For #75933 Change-Id: I996280238e5c70a8d760a0b31e3a13c6a44b8616 Reviewed-on: https://go-review.googlesource.com/c/go/+/721761 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com>
2025-11-14net/http: do not discard body content when closing it within request handlersNicholas S. Husin
(*body).Close() internally tries to discard the content of a request body up to 256 KB. We rely on this behavior to allow connection re-use, by calling (*body).Close() when our request handler exits. Unfortunately, this causes an unfortunate side-effect where we would prematurely try to discard a body content when (*body).Close() is called from within a request handler. There should not be a good reason for (*body).Close() to do this when called from within a request handler. As such, this CL modifies (*body).Close() to not discard body contents when called from within a request handler. Note that when a request handler exits, it will still try to discard the body content for connection re-use. For #75933 Change-Id: I71d2431a540579184066dd35d3da49d6c85c3daf Reviewed-on: https://go-review.googlesource.com/c/go/+/720380 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-11-13net/http: remove unused isLitOrSingle and isNotToken1911860538
isLitOrSingle and isNotToken are private and unused. Change-Id: I07718d4496e92d5f75ed74986e174a8aa1f70a88 GitHub-Last-Rev: 722c4dccd85dca5d28a52e95a4f9efbab2b11807 GitHub-Pull-Request: golang/go#76216 Reviewed-on: https://go-review.googlesource.com/c/go/+/718700 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Sean Liao <sean@liao.dev> Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-11-13net/http/cgi: accept INCLUDED as protocol for server side includesPeter Beard
The existing protocol check for fcgi/cgi requests did not properly account for Apache SSI (Server-Side Includes) SERVER_PROTOCOL value of INCLUDED. Added check for well-known INCLUDED value for proper implementation of the CGI Spec as specified in RFC 3875 - section 4.1.16. The SERVER_PROTOCOL section of the specification is outlined at https://www.rfc-editor.org/rfc/rfc3875.html#section-4.1.16 Fixes #70416 Change-Id: I129e606147e16d1daefb49ed6c13a561a88ddeb6 Reviewed-on: https://go-review.googlesource.com/c/go/+/715680 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Junyang Shao <shaojunyang@google.com> Reviewed-by: Sean Liao <sean@liao.dev> Auto-Submit: Sean Liao <sean@liao.dev>
2025-10-17all: remove unnecessary loop variable copies in testsTobias Klauser
Copying the loop variable is no longer necessary since Go 1.22. Change-Id: Iebb21dac44a20ec200567f1d786f105a4ee4999d Reviewed-on: https://go-review.googlesource.com/c/go/+/711640 Reviewed-by: Florian Lehner <lehner.florian86@gmail.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-16cmd: update to x/tools@7d9453ccAlan Donovan
go get golang.org/x/tools@master go mod tidy go mod vendor in both cmd and src, for (enforced) consistency. Also: GOWORK=off go generate -run=bundle std This will enable use of modernize and inline. Change-Id: I6348dd97ec2c41437b3ca899ed91f10815f2fe26 Reviewed-on: https://go-review.googlesource.com/c/go/+/707135 Reviewed-by: Michael Matloob <matloob@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Alan Donovan <adonovan@google.com> Reviewed-by: Michael Matloob <matloob@golang.org>
2025-10-15net/http/httptest: record failed ResponseWriter writesDamien Neil
CL 709335 changed ResponseWriter.Write to return an error when trying to write to a response with a status code which doesn't permit a body, such as 304. Continue to return an error, but still record the write in ResponseWriter.Body. This maintains the documented property that "the data in buf is written to rw.Body". For #75471 Change-Id: I69139797559fe09d6580c5d25b4458f04263c60e Reviewed-on: https://go-review.googlesource.com/c/go/+/711940 Reviewed-by: Sean Liao <sean@liao.dev> TryBot-Bypass: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com>
2025-10-13all: replace calls to errors.As with errors.AsTypeJulien Cretel
This change replaces most occurrences (in code as well as in comments) of errors.As with errors.AsType. It leaves the errors package and vendored code untouched. Change-Id: I3bde73f318a0b408bdb8f5a251494af15a13118a GitHub-Last-Rev: 8aaaa36a5a12d2a6a90c6d51680464e1a3115139 GitHub-Pull-Request: golang/go#75698 Reviewed-on: https://go-review.googlesource.com/c/go/+/708495 Auto-Submit: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Alan Donovan <adonovan@google.com> Reviewed-by: Michael Pratt <mpratt@google.com>
2025-10-10net/http: strip request body headers on POST to GET redirectsSean Liao
According to WHATWG Fetch, when the body is dropped in a redirect, headers that describe the body should also be dropped. https://fetch.spec.whatwg.org/#http-redirect-fetch Fixes #57273 Change-Id: I84598f69608e95c1b556ea0ce5953ed43bf2d824 Reviewed-on: https://go-review.googlesource.com/c/go/+/710395 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-10net/http: set cookie host to Request.Host when availableSean Liao
When both Request.URL and Request.Host are set, the host in URL is used for connecting at the transport level, while Host is used for the request host line. Cookies should be set for the request, not the underlying connection destination. Fixes #38988 Change-Id: I09053b87ccac67081f6038d205837d9763701526 Reviewed-on: https://go-review.googlesource.com/c/go/+/710335 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-10net/http: run TestRequestWriteTransport with fake time to avoid flakesDamien Neil
This test verifies whether or not we use the chunked encoding when sending a request with a body like io.NopCloser(strings.NewReader("")). This depends on whether the transport can read a single byte from the request body within 200ms, which is flaky on very slow builders. Use fake time to avoid flakes. Fixes #52575 Change-Id: Ie11a58ac6bc18d43af1423827887e804242dee30 Reviewed-on: https://go-review.googlesource.com/c/go/+/710737 Auto-Submit: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-08net/http/httptest: check whether response bodies are allowedSean Liao
Fixes #75471 Change-Id: Ie8fc5fae4b2a9285501198d8379bbffe51ee63f7 Reviewed-on: https://go-review.googlesource.com/c/go/+/709335 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-08net/http: format pprof.goVlad Saioc
Properly formatted net/http/pprof.go to correct inconsistent whitespaces between keys and values for profileSupportsDelta. Change-Id: Iea1515b4289de95862d7eb3af5b8d8d13df2b990 GitHub-Last-Rev: 381d2d3ee746fafdf688b96c8b56a081a1283381 GitHub-Pull-Request: golang/go#75769 Reviewed-on: https://go-review.googlesource.com/c/go/+/709415 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
2025-10-08net/http: update HTTP/2 documentation to reference new config featuresDamien Neil
Update the package docs to point users at the modern HTTP/2 configuration APIs. Mention in the TLSNextProto documentation that this field is superseded by the Protocols field for most user-facing purposes. Change-Id: I30cd9a85a27e1174338f0d6b887f98c28eac5b5d Reviewed-on: https://go-review.googlesource.com/c/go/+/709797 Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-07net/http: add httpcookiemaxnum GODEBUG option to limit number of cookies parsedNicholas Husin
When handling HTTP headers, net/http does not currently limit the number of cookies that can be parsed. The only limitation that exists is for the size of the entire HTTP header, which is controlled by MaxHeaderBytes (defaults to 1 MB). Unfortunately, this allows a malicious actor to send HTTP headers which contain a massive amount of small cookies, such that as much cookies as possible can be fitted within the MaxHeaderBytes limitation. Internally, this causes us to allocate a massive number of Cookie struct. For example, a 1 MB HTTP header with cookies that repeats "a=;" will cause an allocation of ~66 MB in the heap. This can serve as a way for malicious actors to induce memory exhaustion. To fix this, we will now limit the number of cookies we are willing to parse to 3000 by default. This behavior can be changed by setting a new GODEBUG option: GODEBUG=httpcookiemaxnum. httpcookiemaxnum can be set to allow a higher or lower cookie limit. Setting it to 0 will also allow an infinite number of cookies to be parsed. Thanks to jub0bs for reporting this issue. For #75672 Fixes CVE-2025-58186 Change-Id: Ied58b3bc8acf5d11c880f881f36ecbf1d5d52622 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2720 Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/709855 Reviewed-by: Carlos Amedee <carlos@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Michael Pratt <mpratt@google.com>
2025-10-02net/http/httputil: deprecate ReverseProxy.DirectorDamien Neil
The Director function has been superseded by Rewrite. Rewrite avoids fundamental security issues with hop-by-hop header handling in the Director API and has better default handling of X-Forwarded-* headers. Fixes #73161 Change-Id: Iadaf3070e0082458f79fb892ade51cb7ce832802 Reviewed-on: https://go-review.googlesource.com/c/go/+/708615 Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
2025-10-02net/http: update bundled x/net/http2 and delete obsolete http2inTestsNicholas S. Husin
http2inTests is no longer needed after go.dev/cl/708135 and should be deleted. To prevent errors in future vendored dependency updates, h2_bundle.go is also updated together in this change. Change-Id: I7b8c3f6854203fab4ec639a2a268df0cd2b1dee7 Reviewed-on: https://go-review.googlesource.com/c/go/+/708595 Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-10-02runtime,net/http/pprof: goroutine leak detection by using the garbage collectorVlad Saioc
Proposal #74609 Change-Id: I97a754b128aac1bc5b7b9ab607fcd5bb390058c8 GitHub-Last-Rev: 60f2a192badf415112246de8bc6c0084085314f6 GitHub-Pull-Request: golang/go#74622 Reviewed-on: https://go-review.googlesource.com/c/go/+/688335 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: t hepudds <thepudds1460@gmail.com> Auto-Submit: Michael Knyszek <mknyszek@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Carlos Amedee <carlos@golang.org>
2025-09-26net/http: add HTTP2Config.StrictMaxConcurrentRequestsDamien Neil
Add a field to HTTP2Config controlling how we behave when an HTTP/2 connection reaches its concurrency limit. This field will have no effect until golang.org/x/net/http2 is updated to make use of it, and h2_bundle.go is updated with the new http2 package. For #67813 Change-Id: Ic72a0986528abb21649f28e9fe7cf6e1236b388d Reviewed-on: https://go-review.googlesource.com/c/go/+/615875 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> Reviewed-by: Nicholas Husin <husin@google.com>
2025-09-26net/http: add more tests of transport connection poolDamien Neil
Add a variety of addtional tests exercising client connection pooling, in particular HTTP/2 connection behavior. Change-Id: I7609d36db5865f1b95c903cfadb0c3233e046c09 Reviewed-on: https://go-review.googlesource.com/c/go/+/615896 Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Damien Neil <dneil@google.com>
2025-09-18net/http: avoid connCount underflow raceDamien Neil
Remove a race condition in counting the number of connections per host, which can cause a connCount underflow and a panic. The race occurs when: - A RoundTrip call attempts to use a HTTP/2 roundtripper (pconn.alt != nil) and receives an isNoCachedConn error. The call removes the pconn from the idle conn pool and decrements the connCount for its host. - A second RoundTrip call on the same pconn succeeds, and delivers the pconn to a third RoundTrip waiting for a conn. - The third RoundTrip receives the pconn at the same moment its request context is canceled. It places the pconn back into the idle conn pool. At this time, the connCount is incorrect, because the conn returned to the idle pool is not matched by an increment in the connCount. Fix this by not adding HTTP/2 pconns back to the idle pool in wantConn.cancel. Fixes #61474 Change-Id: I104d6cf85a54d0382eebf3fcf5dda99c69a7c3f6 Reviewed-on: https://go-review.googlesource.com/c/go/+/703936 Auto-Submit: Damien Neil <dneil@google.com> Reviewed-by: Nicholas Husin <husin@google.com> Reviewed-by: Nicholas Husin <nsh@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-09-15net/http: clarify panic conditions in Handle, HandleFunc, ↵Cole Garien
AddInsecureBypassPattern Add explicit mention that these methods panic on both pattern conflict and invalid syntax. Fixes #75226 Change-Id: If7dbfc44e1ec4624ab156f0e5d7e66cee2c2fef3 GitHub-Last-Rev: acc9a9c3338373f5a9376ff2eb1decd30bbee04d GitHub-Pull-Request: golang/go#75297 Reviewed-on: https://go-review.googlesource.com/c/go/+/701016 Reviewed-by: Michael Knyszek <mknyszek@google.com> Auto-Submit: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Mark Freeman <markfreeman@google.com>
2025-09-15net/http: add comments for transport gzip readerAlexander Yastrebov
Add back comments dropped in CL 510255 Updates #61353 Change-Id: Ie84610b830599e178140bb5c2a11be74b2ad461e GitHub-Last-Rev: d6cd890dd15aa0f2f8701cf66da11a844bbd011d GitHub-Pull-Request: golang/go#75293 Reviewed-on: https://go-review.googlesource.com/c/go/+/701395 Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Mark Freeman <markfreeman@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com> Auto-Submit: Michael Pratt <mpratt@google.com>
2025-09-12vendor: update x/tools to 3adf0e9, and other reposAlan Donovan
Notably, the x/tools update includes CL 702835. Also, pacify copyright_test report of missing copyright header in generated h2_bundle. Updates golang/go#75432 Change-Id: I428278e50dbcef5dcaa661004da0da9ab8f2c924 Reviewed-on: https://go-review.googlesource.com/c/go/+/702955 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
2025-09-06net/http: pool transport gzip readersAlexander Yastrebov
goos: linux goarch: amd64 pkg: net/http │ HEAD~1 │ HEAD │ │ sec/op │ sec/op vs base │ ClientGzip-8 621.0µ ± 2% 616.3µ ± 10% ~ (p=0.971 n=10) │ HEAD~1 │ HEAD │ │ B/op │ B/op vs base │ ClientGzip-8 49.765Ki ± 0% 9.514Ki ± 2% -80.88% (p=0.000 n=10) │ HEAD~1 │ HEAD │ │ allocs/op │ allocs/op vs base │ ClientGzip-8 57.00 ± 0% 52.00 ± 0% -8.77% (p=0.000 n=10) Allocation saving comes from absent compress/flate.(*dictDecoder).init This change also improves concurrent body read detection by returning an explicit error. Updates #61353 Change-Id: I380acfca912dc009b3b9c8283e27b3526cedd546 GitHub-Last-Rev: df12f6a48af4854ba686fe431a9aeb6d9ba3c303 GitHub-Pull-Request: golang/go#61390 Reviewed-on: https://go-review.googlesource.com/c/go/+/510255 Reviewed-by: Sean Liao <sean@liao.dev> Auto-Submit: Michael Pratt <mpratt@google.com> Reviewed-by: Michael Pratt <mpratt@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2025-09-04net/http: fix cookie value of "" being interpreted as empty string.Nicholas S. Husin
In issue #46443, we have established that double-quotes in cookie values should be kept as part of the value, rather than being discarded. However, we have missed the edge case of "" until now. This CL fixes said edge case. Fixes #75244 Change-Id: I627ad2376931514aa5dcc8961ad804e42b7d9434 Reviewed-on: https://go-review.googlesource.com/c/go/+/700755 Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Nicholas Husin <husin@google.com> Reviewed-by: Damien Neil <dneil@google.com>
2025-08-31net/http: skip redirecting in ServeMux when URL path for CONNECT is emptyNicholas Husin
In 1.21 ServeMux, we had a special-case to skip redirection when a given path is empty for CONNECT requests: https://go.googlesource.com/go/+/refs/tags/go1.24.4/src/net/http/servemux121.go#205. This special case seems to not have been carried over to 1.22 ServeMux. This causes needless redirection, which this CL fixes. Fixes #74422 Change-Id: I3cc5b4d195ab0591a9139225b632cbe17f4290db Reviewed-on: https://go-review.googlesource.com/c/go/+/699915 Reviewed-by: Sean Liao <sean@liao.dev> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Sean Liao <sean@liao.dev> Reviewed-by: Damien Neil <dneil@google.com>
2025-08-29all: delete more windows/arm remnantsTobias Klauser
Updates #71671 Change-Id: I663c4a659ad45bcebfc03d6eb4783e5f5d3afa0d Reviewed-on: https://go-review.googlesource.com/c/go/+/699176 Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Quim Muntal <quimmuntal@gmail.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Carlos Amedee <carlos@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-08-28net/http/httputil: remove redundant pw.Close() call in DumpRequestOut1911860538
pw.Close() is already deferred earlier in DumpRequestOut. Change-Id: Icdc9366c816848ed0bb444022d2aa14e4ceaabac GitHub-Last-Rev: 7c38f9f2b6a9535a9262c2c40c8f1f8754eba972 GitHub-Pull-Request: golang/go#75029 Reviewed-on: https://go-review.googlesource.com/c/go/+/696415 Reviewed-by: Cherry Mui <cherryyz@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Sean Liao <sean@liao.dev> Auto-Submit: Sean Liao <sean@liao.dev>
2025-08-27net/http: Ensure that CONNECT proxied requests respect MaxResponseHeaderBytesNicholas Husin
Currently, CONNECT proxied requests use an unlimited Reader. As a result, a malicious or misbehaving proxy server can send an unlimited number of bytes to a client; causing the client to indefinitely receive bytes until it runs out of memory. To prevent this, we now use a LimitedReader that limits the number of bytes according to MaxResponseHeaderBytes in Transport. If MaxResponseHeaderBytes is not provided, we use the default value of 10 MB that has historically been used (see #26315). Fixes #74633 Change-Id: I0b03bb354139dbc64318874402f7f29cc0fb42ce Reviewed-on: https://go-review.googlesource.com/c/go/+/698915 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-08-27net/http: require exact match for CrossSiteProtection bypass patternsFilippo Valsorda
Fixes #75054 Fixes CVE-2025-47910 Change-Id: I6a6a696440c45c450d2cd681f418b01aa0422a60 Reviewed-on: https://go-review.googlesource.com/c/go/+/699275 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Carlos Amedee <carlos@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 07:43:02 +0000