How to disable HTTP/2 using Server.TLSNextProto

Question

I have a Go server handling https requests:

package main
import (
        "fmt"
        "net/http"
        "log"
)
const (
        port       = "5966"
        cert       = "/tmp/cert.pem"
        key        = "/tmp/key.pem"
)
func main() {

        listen_at := ":" + port
        fmt.Println("Listening at", listen_at)
        go http.HandleFunc("/job_handler/", job_handler)
        log.Fatal(http.ListenAndServeTLS(listen_at, cert, key, nil))
}
func job_handler(w http.ResponseWriter, r *http.Request) {
       // do somework
}

Turns out in https mode, Go has transparent support for the HTTP/2 protocol. We've some clients that noticeably misbehave in HTTP/2, and hence we need to disable HTTP/2 on the server side.

Unfortunately, I can't use ENV variable GODEBUG=http2server=0 to disable HTTP/2. What's left is Server.TLSNextProto as documented here.

How can I use Server.TLSNextProto on my server code above to disable https/2?

It says it right there in the docs you linked: "Programs that must disable HTTP/2 can do so by setting Server.TLSNextProto to a non-nil, empty map." What's unclear about that? — Peter
– Peter, Commented Sep 24, 2019 at 22:57

Grzegorz Żur · Accepted Answer · 2019-10-02 07:30:33Z

12

The simplest setup that disables HTTP/2 is

package main

import (
    "log"
    "net/http"
    "crypto/tls"
)

func main() {

    m := http.NewServeMux()

    srv := &http.Server{
        Handler:      m,
        Addr:         "127.0.0.1:8080",
        TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler)),
    }

    log.Fatal(srv.ListenAndServe())

}

You can verify the support with

curl -v --http2-prior-knowledge http://localhost:8080

edited Oct 2, 2019 at 7:30

answered Sep 25, 2019 at 9:42

Grzegorz Żur

49.5k17 gold badges122 silver badges112 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

struggling_learner Over a year ago

Thank you, and +1 for the curl verification tip!

Martin Del Vecchio Over a year ago

Grzegorz can you tell me how that command verifies that HTTP2 is disabled? I am trying to disable HTTP2 in this manner, and the equivalent curl command is telling me "Connection state changed (HTTP/2 confirmed)" and then "Failed sending HTTP2 data, * nghttp2_session_send() failed: The user callback function failed(-902)" Is this what I should see? It sounds to me like this method has not in fact disabled HTTP2. Thanks.

Grzegorz Żur Over a year ago

@MartinDelVecchio The command parameters tells curl to use HTTP/2 protocol only. If the tool fails to communicate with server it means that HTTP/2 is not available. It is what we wanted to achieve.

Martin Del Vecchio Over a year ago

OK. I am seeing the same errors when I don't tell curl to use HTTP2. When I explicitly tell it to use HTTP 1.1, I get success. But when I don't tell it, it tries HTTP2, fails, and returns an error.

Andrew W. Phillips · Accepted Answer · 2024-05-24 07:19:41Z

1

Just an update since the OP said:

Unfortunately, I can't use ENV variable GODEBUG=http2server=0

In Go 1.21 and later you can just add //go:debug http2server=0 at the top of any source file of the main package. See The Go Blog

answered May 24, 2024 at 7:19

Andrew W. Phillips

3,6001 gold badge24 silver badges27 bronze badges

Collectives™ on Stack Overflow

How to disable HTTP/2 using Server.TLSNextProto

2 Answers 2

4 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related