allow serving HTTP/2 without HTTP/1.1 fallback

[Gunni]

Issue Details

Please allow entirely disabling HTTP/1.1 both for front and backend/reverse_proxy.

See golang net/http response here.

Assistance Disclosure

AI not used

If AI was used, describe the extent to which it was used.

No response

Why

https://http1mustdie.com/

[mholt]

Hi, thanks for opening an issue.

From our docs:

Currently, enabling HTTP/2 (including H2C) necessarily implies enabling HTTP/1.1 because the Go standard library does not let us disable HTTP/1.1 when using its HTTP server. However, either HTTP/1.1 or HTTP/3 can be enabled independently.

You'll need to ask the Go project to make this possible first, unless they recently have already. We can reopen the feature request at that time. Feel free to continue discussion though.

What is your use case?

[Gunni]

But they said it's possible already?

My use case is preventing request smuggling.

[mholt]

Ah, I missed your link. Thank you. Indeed, looks like there is some new functionality.

We're not aware of any Caddy deployments affected by what is described at the other link you posted, but if you really need this, we're happy to accept a PR to implement the change. I'm a little busy at the moment myself though.

[WeidiDeng]

I think it's already possible, after 6961. The documentation just isn't up to date.

Did you try to specify only h2 in the global options in the latest caddy? @Gunni

[WeidiDeng]

I just checked, although the configuration is deemed valid by caddy, h2 can't be used whatsoever.

[WeidiDeng]

It appears something changed with golang 1.25, as caddy built with golang 1.24 (with changes to go.mod) will behave correctly with the following config.

{
    debug
    skip_install_trust
    local_certs
    servers :443 {
        protocols h2
    }
}

localhost {
    respond "OK" 200
}

With caddy built with golang 1.25, no response will be received.

Use the following client test code,

package main

import (
	"crypto/tls"
	"net/http"
	"os"
)

func main() {
	client := &http.Client{Transport: &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true, NextProtos: []string{
		//"http/1.1",
		"h2",
	}}, ForceAttemptHTTP2: true}}
	resp, err := client.Get("https://localhost")
	if err != nil {
		panic(err)
	}
	_ = resp.Write(os.Stdout)
}

[WeidiDeng]

Also, when listener_wrappers is used, if they return a connection that implements

type connectionStater interface {
	ConnectionState() tls.ConnectionState
}

Those will fail in golang 1.25