🐛 Fixed protocol violation when the Connection header is sent for HTT…

…P/2 and HTTP/3 (#16) …
jawah · Sep 12, 2023 · 4b86435 · 4b86435
1 parent 97fafa1
commit 4b86435
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/changelog/16.bugfix.rst b/changelog/16.bugfix.rst
@@ -0,0 +1,2 @@
+Fixed protocol violation for HTTP/2 and HTTP/3 where we sent ``Connection: keep-alive`` when it is
+forbidden.
diff --git a/src/urllib3/backend/hface.py b/src/urllib3/backend/hface.py
@@ -602,6 +602,13 @@ def endheaders(
             except ValueError:
                 pass
 
+            # Passing 'Connection' header is actually a protocol violation above h11.
+            # We assume it is passed as-is (meaning 'keep-alive' lower-cased)
+            try:
+                self.__headers.remove((b"connection", b"keep-alive"))
+            except ValueError:
+                pass
+
             # some quic/h3 implementation like quic-go skip reading the body
             # if this indicator isn't present, equivalent to te: chunked but looking for stream FIN marker.
             # officially, it should not be there. kept for compatibility.