Skip to content

Comments

fix: respect -pr http11 flag by disabling HTTP/2 fallback in retryablehttp#2413

Open
sharkqwy wants to merge 1 commit intoprojectdiscovery:mainfrom
sharkqwy:fix/http11-protocol-flag
Open

fix: respect -pr http11 flag by disabling HTTP/2 fallback in retryablehttp#2413
sharkqwy wants to merge 1 commit intoprojectdiscovery:mainfrom
sharkqwy:fix/http11-protocol-flag

Conversation

@sharkqwy
Copy link

Description

Fixes #2240

When the user specifies -pr http11, httpx correctly disables HTTP/2 on the primary transport by:

  1. Setting GODEBUG=http2client=0
  2. Setting transport.TLSNextProto to an empty map

However, retryablehttp-go's internal HTTPClient2 (used as a fallback when HTTP/1.x encounters malformed HTTP/2 responses in do.go:63-64) still has HTTP/2 enabled via http2.ConfigureTransport. This silently upgrades connections to HTTP/2 and defeats the -pr http11 flag.

Fix

After creating the retryablehttp client, when Protocol == "http11", override HTTPClient2 to use the same HTTP/1.1-only transport. This ensures no HTTP/2 fallback occurs at any level.

Changes

  • common/httpx/httpx.go: Set HTTPClient2 to use the HTTP/1.1-only transport when -pr http11 is specified

Verification

Before (with -pr http11):

  • retryablehttp detects HTTP/1.x error → falls back to HTTPClient2 (HTTP/2 enabled) → connection upgraded to HTTP/2

After (with -pr http11):

  • retryablehttp detects HTTP/1.x error → falls back to HTTPClient2 (HTTP/2 disabled) → stays on HTTP/1.1

…ehttp

When the user specifies -pr http11, httpx correctly disables HTTP/2 on the
primary transport. However, retryablehttp-go's internal HTTPClient2 (used as
a fallback when HTTP/1.x encounters HTTP/2 responses) still has HTTP/2
enabled, which silently upgrades connections and defeats the -pr flag.

This fix sets HTTPClient2 to use the same HTTP/1.1-only transport when
Protocol is 'http11', ensuring no HTTP/2 fallback occurs.

Fixes projectdiscovery#2240
@auto-assign auto-assign bot requested a review from dwisiswant0 February 20, 2026 08:24
@coderabbitai
Copy link

coderabbitai bot commented Feb 20, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant