This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 37c0cc340d Do not send Early Hints to HTTP/1.0 clients (#1149)
37c0cc340d is described below
commit 37c0cc340db54bbdba79e6899fbe0e28e18ee1c0
Author: Arturo Bernal <[email protected]>
AuthorDate: Fri Nov 13 15:34:11 2026 +0100
Do not send Early Hints to HTTP/1.0 clients (#1149)
RFC 9110, section 15.2 states that, since HTTP/1.0 did not define any 1xx
status codes, a server MUST NOT send a 1xx response to an HTTP/1.0 client.
A 103 response was sent to an HTTP/1.0 client when the application called
sendEarlyHints(). Skip the early hints for requests that are not HTTP/1.1.
---
java/org/apache/coyote/http11/Http11Processor.java | 4 +++
.../apache/coyote/http11/TestHttp11Processor.java | 33 ++++++++++++++++++++++
webapps/docs/changelog.xml | 5 ++++
3 files changed, 42 insertions(+)
diff --git a/java/org/apache/coyote/http11/Http11Processor.java
b/java/org/apache/coyote/http11/Http11Processor.java
index 28036f055f..d122f33e9d 100644
--- a/java/org/apache/coyote/http11/Http11Processor.java
+++ b/java/org/apache/coyote/http11/Http11Processor.java
@@ -1320,6 +1320,10 @@ public class Http11Processor extends AbstractProcessor {
@Override
protected void earlyHints() throws IOException {
+ // A server must not send a 1xx response to an HTTP/1.0 client (RFC
9110, section 15.2)
+ if (!http11) {
+ return;
+ }
writeHeaders(HttpServletResponse.SC_EARLY_HINTS,
response.getMimeHeaders());
outputBuffer.writeHeaders();
outputBuffer.resetHeaderBuffer();
diff --git a/test/org/apache/coyote/http11/TestHttp11Processor.java
b/test/org/apache/coyote/http11/TestHttp11Processor.java
index 6ed4bbb838..57e99578d9 100644
--- a/test/org/apache/coyote/http11/TestHttp11Processor.java
+++ b/test/org/apache/coyote/http11/TestHttp11Processor.java
@@ -2234,6 +2234,39 @@ public class TestHttp11Processor extends TomcatBaseTest {
}
+ /*
+ * RFC 9110, section 15.2: a server MUST NOT send a 1xx response to an
HTTP/1.0 client.
+ */
+ @Test
+ public void testEarlyHintsHttp10() throws Exception {
+ Tomcat tomcat = getTomcatInstance();
+
+ // No file system docBase required
+ Context ctx = getProgrammaticRootContext();
+
+ // Add servlet
+ Tomcat.addServlet(ctx, "EarlyHintsServlet", new EarlyHintsServlet());
+ ctx.addServletMapping("/ehs", "EarlyHintsServlet");
+
+ tomcat.start();
+
+ // @formatter:off
+ String request =
+ "GET /ehs HTTP/1.0" + CRLF +
+ "Host: localhost:" + getPort() + CRLF +
+ CRLF;
+ // @formatter:on
+
+ Client client = new Client(tomcat.getConnector().getLocalPort());
+ client.setRequest(new String[] { request });
+
+ client.connect(600000, 600000);
+ client.processRequest(false);
+
+ // The first (and only) response must be the final response
+ Assert.assertEquals(HttpServletResponse.SC_OK, client.getStatusCode());
+ }
+
private static class EarlyHintsServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 0ce99fd4e0..6724810a47 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -297,6 +297,11 @@
read the request line, as required by RFC 9112, section 3. Pull request
<pr>1147</pr> provided by Arturo Bernal. (markt)
</fix>
+ <fix>
+ Do not send a 103 (Early Hints) response to an HTTP/1.0 client as a
+ server must not send a 1xx response to an HTTP/1.0 client. (RFC 9110,
+ section 15.2) (abernal)
+ </fix>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
