Curl doesn't send request body when the server responds with HTTP 101

[djelinski]

I did this

Using a local Liberty server and curl 8.3.0 client, I sent a HTTP POST request over plain HTTP1 as follows:

curl --http2 -v -H"Expect:100-continue" http://localhost:9080/system/greeter/hello --data "foo"

The server sent the following 2 response headers in quick succession:

HTTP/1.1 100 Continue
Content-Length: 0
Date: Tue, 03 Oct 2023 19:06:00 GMT

HTTP/1.1 101 Switching Protocols
Date: Tue, 03 Oct 2023 19:06:00 GMT
Upgrade: h2c
Connection: Upgrade
Content-Length: 0

In response to that, Curl sent the HTTP2 connection preface without sending the data.
It doesn't fail every time; sometimes when the HTTP 101 header is late enough, curl manages to send the request body correctly.

I expected the following

I expected curl to send the request data before sending the HTTP2 preface

curl/libcurl version

curl 8.3.0 (x86_64-w64-mingw32) libcurl/8.3.0 OpenSSL/3.1.2 (Schannel) zlib/1.3 brotli/1.1.0 zstd/1.5.5 WinIDN libssh2/1.11.0 nghttp2/1.56.0 ngtcp2/0.19.1 nghttp3/0.15.0

operating system

Windows 11

[bagder]

I bet the double 10x responses is the reason.

[icing]

This is not a valid server response. It points to a bug in the server.

[djelinski]

https://datatracker.ietf.org/doc/html/rfc7230#section-6.7 appears to suggest that the server response is valid:

A client cannot begin using an upgraded protocol on the connection until it has completely sent the request message (i.e., the client can't change the protocol it is sending in the middle of a message). If a server receives both an Upgrade and an Expect header field with the "100-continue" expectation (Section 5.1.1 of [RFC7231]), the server MUST send a 100 (Continue) response before sending a 101 (Switching Protocols) response.

[icing]

Ah, @djelinski thanks for the link. You learn something new every day. In Apache httpd, I never allow protocol switching on requests with a body. Which allows me to remain ignorant so far of these intricacies.

The easiest way to fix the curl handling of this would be, my guess, to never send Upgrade: together with an Expect:, I guess.

[bagder]

Sensible. Or do it like you mention Apache does, avoid the upgrade if there's a request body.