EXCEPTION(tcp_error): Request could not be handled with HTTP/2 Proxy

Products

• ProxySG Software - SGOS
• ISG Proxy

Issue/Introduction

Accessing some websites through the ProxySG results in the browser displaying the error message EXCEPTION(tcp_error): Request could not be handled.

Environment

SGOS versions prior to 7.3.11.1

Cause

This issue can occur when communicating with web servers that partially support HTTP/2. In these scenarios, they start the connection using HTTP/2 but there is a request to downgrade to HTTP/1.1. For instance, servers, such as,  IIS do not support authentication (and possibly other cases) over HTTP/2. They may send back a RST_STREAM frame with error code HTTP_1_1_REQUIRED, which indicates that the client should retry over HTTP/1.1. The proxy currently translates any received upstream RST_STREAM to a pseudo socket close; so the HTTP proxy just sees this as a generic tcp_error and generates a 503 exception page and the client browser doesn't know why it failed.

Web Browsers such as Chromium and Mozilla have added support for this downgrade mechanism whereby they will re-issue requests over HTTP/1.1 when receiving the HTTP_1_1_REQUIRED error code.

Resolution

To support this functionality in SGOS, the HTTP/2 proxy will now propagate this error message to the client-side HTTP/2 connection so the browser can proceed with its downgrade behavior.

Support for this functionality is available in release 7.3.11.1 and newer.

 

Workaround (applicable to 7.3 versions prior to 7.3.11.1 or later):

Disable HTTP/2 for the website.

<proxy>
client.connection.ssl_server_name.substring=example.com http2.client.accept(no) http2.server.request(no)