Add a way to override :authority header in http2 request

[FlipSs]

Hello!
We need a way to connect to the server by it's IP Address and specify a host to redirect request to.
There is no way to do that now.

HPACKEncoder class, line 45. Authority header value taken from request Uri.

https://datatracker.ietf.org/doc/html/rfc7540#section-8.1.2.3

[Benedicht]

What server uses the :authority header as a redirect to command? If you know where you want your request redirected, why don't you send it to that server instead?
Could you quote text from the link that you think would be relevant for this issue?

[FlipSs]

Sorry for such a short description.

We use HAProxy as a proxy for all requests. In order to determine which backend the request came to, it needs a Host header. As far as I understand in http 2 client should use the :authority pseudo header instead of Host.
Calling by IP is needed to be able to do some balancing on the client side, so instead of creating domains for each service instance, you can make 1 domain for all instances, client resolves it and gets multiple IP addresses and can switch them depending on the situation.
In the current implementation of the library, when making a request with an IP address in the Uri, the value of :authority is that IP address. If I set domain name in the :authority header, everything works fine. Perhaps, as a compatibility with http1, the :authority header should take the value of the Host header if it was set by the user.

Relevant text from the link:
Clients that generate HTTP/2 requests directly SHOULD use the ":authority" pseudo-header field instead of the Host header field. An intermediary that converts an HTTP/2 request to HTTP/1.1 MUST create a Host header field if one is not present in a request by copying the value of the ":authority" pseudo-header field.

[Benedicht]

I'm trying to wrap my head around what you wrote, but i still don't get it. You have one domain name with multiple IP addresses, but when you connect to one of these addresses, you want to specify a different domain? On all IP addresses there's a HAProxy instance that going to route the request to the specified domain?
Why you use a load balancer (HAProxy) if the load balancing is done by the client? You could add the IP addresses of the real backend servers to the main domain skipping the intermediary HAProxy instances. By adding and setting up DNS load balancing on top of it, you could reduce the complexity of your setup while using well understood and standard way of load balancing.

The quoted text refers to indermediaries (like proxies and load balancers) when it has to communicate with the client through http/2 but have to send request to the server using http/1. When creates the http/1 request to send it to the server it must use the client's :authority header's value for the new request's host header.

[thyn]

We have some concerns about DNS load balancing.

• We are using Azure dns and amazon - they have some time problems with availability . 2 time for last 3 months.
• We can cache ips locally and have access to our servers even dns is not available.

I understand that it's rare situation, but it's very small fix and I doesn't see why it can't be supported. That's why we need to specify ips

Another thoughts

• We have failover ips on haproxy servers. We use different hosters and they sometimes doesn't have failover ips or it's complicated to setup new scripts each time when we use another hoster. We are trying to be hoster independent.
• Direct backend are not safe. Complicated https setup and we cannot limit connections (not more then 500 new connections per app instance) to each server or filter ips by anticaptcha (for web) or by requests per second, session stickiness by client ip and so on. We need to write our own balancer to have it. It's very bad advice for us.

[Benedicht]

Thanks for adding more details @thyn !

While it would be a small change, i'm not convinced about its added value. It's working like the http/2 specifcation directs, and if i change it, the burden of support is on me, not on you.
How you set up HAProxy to make decisions based on the :authority header? I think if you can choose a server based on that header, you could use any other custom header too.

[thyn]

I understand your concerns. The main problem is not with haproxy. We can't make request by ip with host(authority) header. Our haproxy serves a lot of services and we make decisions by hdr(host). In case http2 it's authority. We also can put host header in custom header but it looks like a little crunch.

Also we don't understand why we are not having problem with ssl when we connect using ip. Our certificate doesn't contain our ip. If we use custom header i'm not sure about future certificate problems.