Unencrypted HTTP/2 requests forwarded to downstream as HTTP/1.1

[danbo0001]

I have an Ocelot gateway receiving http traffic using the http2 protocol configured as follows:

The Ocelot host endpoint protocol set to Http2 in appsettings.json:

  "Kestrel": {
    "EndpointDefaults": {
      "Protocols": "Http2"
    }
  }

The Ocelot configuration file has one route which has the scheme and version set:

    {
      "DownstreamPathTemplate": "/downstream-path/{everything}",
      "DownstreamScheme": "http",
      "DownstreamHttpVersion": 2.0,
      "DownstreamHostAndPorts": [
        {
          "Host": "downstream-host",
          "Port": 5003
        }
      ],
      "UpstreamPathTemplate": "/upstream-path/{everything}",
      "UpstreamHttpMethod": []
    }

The downstream host is configured with two listeners, one for each http protocol:

  "Kestrel": {
    "Endpoints": {
      "Http1": {
        "Url": "http://0.0.0.0:5002",
        "Protocols": "Http1"
      },
      "Http2": {
        "Url": "http://0.0.0.0:5003",
        "Protocols": "Http2"
      }
    }
  },

In the trace log, I can see the test request comes in to Ocelot as http2, but then the downstream host trace log shows an error indicating it was received as http1.1:

[2024-04-10 15:20:26.399748 +00:00 INF] Request starting "HTTP/2" "GET" "http"://"localhost:5201" - null null
[2024-04-10 15:20:26.404575 +00:00 DBG] Wildcard detected, all requests with hosts will be allowed.
[2024-04-10 15:20:26.424844 +00:00 DBG] requestId: 0HN2PE6VSF6O6:00000001, previousRequestId: No PreviousRequestId, message: 'ocelot pipeline started'
[2024-04-10 15:20:26.429363 +00:00 DBG] requestId: 0HN2PE6VSF6O6:00000001, previousRequestId: No PreviousRequestId, message: 'Upstream url path is /upstream-path'
[2024-04-10 15:20:26.448092 +00:00 DBG] requestId: 0HN2PE6VSF6O6:00000001, previousRequestId: No PreviousRequestId, message: 'downstream templates are /downstream-path/{everything}'
[2024-04-10 15:20:26.526829 +00:00 INF] requestId: 0HN2PE6VSF6O6:00000001, previousRequestId: No PreviousRequestId, message: 'EndpointRateLimiting is not enabled for /downstream-path/{everything}'
[2024-04-10 15:20:26.530658 +00:00 INF] requestId: 0HN2PE6VSF6O6:00000001, previousRequestId: No PreviousRequestId, message: 'No authentication needed for /downstream-path'
[2024-04-10 15:20:26.534090 +00:00 INF] requestId: 0HN2PE6VSF6O6:00000001, previousRequestId: No PreviousRequestId, message: '/downstream-path/{everything} route does not require user to be authorized'
[2024-04-10 15:20:26.562909 +00:00 WRN] requestId: 0HN2PE6VSF6O6:00000001, previousRequestId: No PreviousRequestId, message: 'Route Ocelot.Values.UpstreamPathTemplate specifies use QoS but no QosHandler found in DI container. Will use not use a QosHandler, please check your setup!'
[2024-04-10 15:20:26.606826 +00:00  DBG] Connection id ""0HN2PE6VUU827"" accepted.
[2024-04-10 15:20:26.608544 +00:00  DBG] Connection id ""0HN2PE6VUU827"" started.
[2024-04-10 15:20:26.645792 +00:00  DBG] Connection id ""0HN2PE6VUU827"": Invalid content received on connection. Possible incorrect HTTP version detected. Expected "HTTP/2" but received "HTTP/1.1".

Just out of interest, I changed just the route downstream port from 5003 to 5002 (i.e. left the http version at 2.0) and the downstream host trace confirmed it received the request as http1.1. There are no errors in the log and no entries saying why the protocol might have been changed:-

[2024-04-10 13:28:15.631821 +00:00 INF] Request starting "HTTP/2" "GET" "http"://"localhost:5201/..." - null null
[2024-04-10 13:28:15.633362 +00:00 DBG] requestId: 0HN2PC7A4B8LJ:00000001, previousRequestId: No PreviousRequestId, message: 'ocelot pipeline started'
[2024-04-10 13:28:15.633581 +00:00 DBG] requestId: 0HN2PC7A4B8LJ:00000001, previousRequestId: No PreviousRequestId, message: 'Upstream url path is /upstream-path'
[2024-04-10 13:28:15.634346 +00:00 DBG] requestId: 0HN2PC7A4B8LJ:00000001, previousRequestId: No PreviousRequestId, message: 'downstream templates are /downstream-path/{everything}'
[2024-04-10 13:28:15.636627 +00:00 INF] requestId: 0HN2PC7A4B8LJ:00000001, previousRequestId: No PreviousRequestId, message: 'EndpointRateLimiting is not enabled for /downstream-path/{everything}'
[2024-04-10 13:28:15.636830 +00:00 INF] requestId: 0HN2PC7A4B8LJ:00000001, previousRequestId: No PreviousRequestId, message: 'No authentication needed for /downstream-path'
[2024-04-10 13:28:15.637101 +00:00 INF] requestId: 0HN2PC7A4B8LJ:00000001, previousRequestId: No PreviousRequestId, message: '/downstream-path/{everything} route does not require user to be authorized'
[2024-04-10 13:28:15.637950 +00:00 DBG] requestId: 0HN2PC7A4B8LJ:00000001, previousRequestId: No PreviousRequestId, message: 'Downstream url is http://downstream-path/...'
[2024-04-10 13:28:15.652889 +00:00  DBG] Connection id ""0HN2PC7A6FTLS"" accepted.
[2024-04-10 13:28:15.653597 +00:00  DBG] Connection id ""0HN2PC7A6FTLS"" started.
[2024-04-10 13:28:15.698999 +00:00  INF] Request starting "HTTP/1.1" "GET" "http"://"downstream-path/..." - null 0

I think I have configured everything correctly so I am wondering if there is a limitation in Ocelot in that it will only forward downstream as http2 if the downstream scheme is https or maybe I need extra configuration to make it work in this way.
Can anyone help?

[raman-m]

Hi @danbo0001,
This limitation stems from Ocelot's default version policy, which doesn't allow it to advance as far as the .NET framework. We are addressing this issue in PR #1673.

@ibnuda @ggnaegi,
Could this issue be linked to both #1672 and #1673?
I believe so.

[ggnaegi]

@raman-m Yes, it should be related.

[raman-m]

@danbo0001 Please subscribe to #1673 and watch for the PR delivery please.
Going to close this discussion...