EXCEPTION(tcp_error): Request could not be handled with HTTP/2 Proxy

Products

• ProxySG Software - SGOS

Issue/Introduction

Accessing some websites through the ProxySG results in the browser displaying the error message EXCEPTION(tcp_error): Request could not be handled.

Environment

SGOS versions prior to 7.3.11.1

Cause

This issue can occur when communicating with web servers that partially support HTTP/2. In these scenarios, they start the connection using HTTP/2 but request a downgrade to HTTP/1.1 for some requests. For instance, servers like IIS don't support auth (and possibly other cases) over HTTP/2. They may send back a RST_STREAM frame with error code HTTP_1_1_REQUIRED, which indicates that the client should retry over HTTP/1.1. The proxy currently translates any received upstream RST_STREAM to a pseudo socket close; so the HTTP proxy just sees this as a generic tcp_error and generates a 503 exception page, and the client browser doesn't know why it failed.

Web Browsers such as Chromium and Mozilla have added support for this downgrade mechanism whereby they will re-issue requests over HTTP/1.1 when receiving the HTTP_1_1_REQUIRED error code.

Resolution

To support this functionality in SGOS, the HTTP/2 proxy will now propagate this error message to the client-side HTTP/2 connection so the browser can proceed with its downgrade behavior.

Support for this functionality is available in release 7.3.11.1+

 

Workaround (applicable to 7.3 versions prior to 7.3.11.1 or later):

Disable HTTP/2 for the website.

<proxy>
client.connection.ssl_server_name.substring=example.com http2.client.accept(no) http2.server.request(no)