`Alt-Svc: clear` without an ending semicolon has no effect

[Lubrsi]

I did this

Using libcurl in Ladybird, I set CURLOPT_ALTSVC to a filepath. I then connected to https://developer.mozilla.org/en-US/ which responds with the following alt-svc headers in this order:

alt-svc: h3=":443"; ma=2592000
alt-svc: clear

See the libcurl usage here: https://github.com/LadybirdBrowser/ladybird/blob/941da11ece90b7edc5d7887dde01671bd9052bb0/Services/RequestServer/ConnectionFromClient.cpp#L494

I expected the following

I expected it to clear the HTTP/3 Alt-Svc entry, however it was kept. This caused subsequent connections to use HTTP/3, which the given server does not support at the time of writing.

Looking at the following unit test, it appears that if it ends with a semicolon, it functions correctly. However, there is not a test for if it does not end with a semicolon:

curl/tests/unit/unit1654.c

Lines 92 to 96 in 9bdd08b

	/* clear that one again and decrease the counter */
	result = Curl_altsvc_parse(curl, asi, "clear;\r\n",
	ALPN_h1, "curl.se", 80);
	fail_if(result, "Curl_altsvc_parse(7) failed!");
	fail_unless(Curl_llist_count(&asi->list) == 10, "wrong number of entries");

curl/libcurl version

libcurl/8.14.1-DEV OpenSSL/3.5.0 zlib/1.3.1 brotli/1.1.0 zstd/1.5.7 nghttp2/1.66.0 ngtcp2/1.13.0 nghttp3/1.10.1

operating system

Darwin Mac.lan 24.5.0 Darwin Kernel Version 24.5.0: Tue Apr 22 19:53:27 PDT 2025; root:xnu-11417.121.6~2/RELEASE_ARM64_T6041 arm64

[bagder]

Can you verify that #17918 fixes this for you?

[Lubrsi]

Yes, it does, thank you very much!

Verbose output from Ladybird with the patch, demonstrating that subsequent requests after requesting /en-US/ does not use HTTP/3

* Added developer.mozilla.org:443:2600:1901:0:ab4c::,34.111.97.67 to DNS cache * Hostname developer.mozilla.org was found in DNS cache * Trying [2600:1901:0:ab4c::]:443... * ALPN: curl offers h2,http/1.1 * CAfile: /etc/ssl/cert.pem * CApath: none * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / RSASSA-PSS * ALPN: server accepted h2 * Server certificate: * subject: CN=developer.mozilla.org * start date: Jul 5 01:40:15 2025 GMT * expire date: Oct 3 02:36:10 2025 GMT * subjectAltName: host "developer.mozilla.org" matched cert's "developer.mozilla.org" * issuer: C=US; O=Google Trust Services; CN=WR3 * SSL certificate verify ok. * Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption * Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption * Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha384WithRSAEncryption * Connected to developer.mozilla.org (2600:1901:0:ab4c::) port 443 * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://developer.mozilla.org/en-US/ * [HTTP/2] [1] [:method: GET] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: developer.mozilla.org] * [HTTP/2] [1] [:path: /en-US/] * [HTTP/2] [1] [accept-encoding: deflate, gzip, br, zstd] * [HTTP/2] [1] [user-agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0] * [HTTP/2] [1] [sec-fetch-site: cross-site] * [HTTP/2] [1] [accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] * [HTTP/2] [1] [accept-language: en] * [HTTP/2] [1] [sec-fetch-dest: document] * [HTTP/2] [1] [sec-fetch-mode: navigate] > GET /en-US/ HTTP/2 Host: developer.mozilla.org Accept-Encoding: deflate, gzip, br, zstd User-Agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0 Sec-Fetch-Site: cross-site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate

• Request completely sent off
  < HTTP/2 200
  < x-guploader-uploadid: ABgVH883X-kZGbNLJ32a7wlC9-jvXqJkW1UtBN1idsBdGN06Jq_KuLv8pe0M5O6yAn-EjfI
  < x-goog-generation: 1752367601000837
  < x-goog-metageneration: 1
  < x-goog-stored-content-encoding: identity
  < x-goog-stored-content-length: 44808
  < x-goog-meta-goog-reserved-file-mtime: 1752366359
  < x-goog-hash: crc32c=ADUzLA==, md5=F0/GU/H2jC9TlSphSKwUIQ==
  < x-goog-storage-class: STANDARD
  < accept-ranges: none
• Added alt-svc: developer.mozilla.org:443 over h3
  < alt-svc: h3=":443"; ma=2592000
  < alt-svc: clear
  < x-content-type-options: nosniff
  < strict-transport-security: max-age=63072000
  < content-security-policy: default-src 'self'; script-src 'report-sample' 'self' 'wasm-unsafe-eval' https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/js assets.codepen.io production-assets.codepen.io https://js.stripe.com 'sha256-EehWlTYp7Bqy57gDeQttaWKp0ukTTEUKGP44h8GVeik=' 'sha256-XNBp89FG76amD8BqrJzyflxOF9PaWPqPqvJfKZPCv7M='; script-src-elem 'report-sample' 'self' 'wasm-unsafe-eval' https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/js assets.codepen.io production-assets.codepen.io https://js.stripe.com 'sha256-EehWlTYp7Bqy57gDeQttaWKp0ukTTEUKGP44h8GVeik=' 'sha256-XNBp89FG76amD8BqrJzyflxOF9PaWPqPqvJfKZPCv7M='; style-src 'report-sample' 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; connect-src 'self' developer.allizom.org bcd.developer.allizom.org bcd.developer.mozilla.org updates.developer.allizom.org updates.developer.mozilla.org https://.google-analytics.com https://.analytics.google.com https://*.googletagmanager.com https://incoming.telemetry.mozilla.org https://observatory-api.mdn.allizom.net https://observatory-api.mdn.mozilla.net https://api.github.com/search/issues stats.g.doubleclick.net https://api.stripe.com; font-src 'self'; frame-src 'self' interactive-examples.mdn.mozilla.net interactive-examples.mdn.allizom.net mdn.github.io live-samples.mdn.mozilla.net live-samples.mdn.allizom.net *.mdnplay.dev *.mdnyalp.dev *.play.test.mdn.allizom.net https://v2.scrimba.com https://scrimba.com jsfiddle.net www.youtube-nocookie.com codepen.io survey.alchemer.com https://js.stripe.com; img-src 'self' data: *.githubusercontent.com .googleusercontent.com .gravatar.com mozillausercontent.com firefoxusercontent.com profile.stage.mozaws.net profile.accounts.firefox.com developer.mozilla.org mdn.dev interactive-examples.mdn.mozilla.net interactive-examples.mdn.allizom.net wikipedia.org upload.wikimedia.org https://mdn.github.io/shared-assets/ https://mdn.dev/ https://.google-analytics.com https://.googletagmanager.com www.gstatic.com; manifest-src 'self'; media-src 'self' archive.org videos.cdn.mozilla.net https://mdn.github.io/shared-assets/; child-src 'self'; worker-src 'self';
  < x-frame-options: DENY
  < origin-trial: AxVILwizhbMjxFeHOn1P3R8niO1RJY/smaK4B4d1rLzc1gTaxtXMSaTi+FoigYgCw40uFRDwFcEAeqDR+vVLOW4AAABfeyJvcmlnaW4iOiJodHRwczovL2RldmVsb3Blci5tb3ppbGxhLm9yZyIsImZlYXR1cmUiOiJQcml2YXRlQXR0cmlidXRpb25WMiIsImV4cGlyeSI6MTc0MjA3OTYwMH0=
  < x-cloud-trace-context: 877958d53e4c8969cc304c080e7de969
  < server: Google Frontend
  < via: 1.1 google
  < content-encoding: br
  < date: Sun, 13 Jul 2025 14:51:29 GMT
  < expires: Sun, 13 Jul 2025 15:26:10 GMT
  < cache-control: public, max-age=3600
  < age: 1519
  < last-modified: Sun, 13 Jul 2025 00:46:41 GMT
  < etag: W/"174fc653f1f68c2f53952a6148ac1421"
  < content-type: text/html
  < vary: Accept-Encoding
  < content-length: 9504
  < x-cache: hit
  <
• Connection #0 to host developer.mozilla.org left intact
• RESOLVE developer.mozilla.org:443 - old addresses discarded
• Added developer.mozilla.org:443:2600:1901:0:ab4c::,34.111.97.67 to DNS cache
• Re-using existing https: connection with host developer.mozilla.org
• [HTTP/2] [3] OPENED stream for https://developer.mozilla.org/favicon.ico
• [HTTP/2] [3] [:method: GET]
• [HTTP/2] [3] [:scheme: https]
• [HTTP/2] [3] [:authority: developer.mozilla.org]
• [HTTP/2] [3] [:path: /favicon.ico]
• [HTTP/2] [3] [accept: /]
• [HTTP/2] [3] [accept-encoding: deflate, gzip, br, zstd]
• [HTTP/2] [3] [user-agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0]

GET /favicon.ico HTTP/2
Host: developer.mozilla.org
Accept: /
Accept-Encoding: deflate, gzip, br, zstd
User-Agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0

• Request completely sent off
  9082.311 WebContent(64104): ResourceLoader: Filtered request to: "https://developer.mozilla.org/static/js/gtag.js"
• RESOLVE developer.mozilla.org:443 - old addresses discarded
• Added developer.mozilla.org:443:2600:1901:0:ab4c::,34.111.97.67 to DNS cache
• Multiplexed connection found
• Re-using existing https: connection with host developer.mozilla.org
• [HTTP/2] [5] OPENED stream for https://developer.mozilla.org/favicon.svg
• [HTTP/2] [5] [:method: GET]
• [HTTP/2] [5] [:scheme: https]
• [HTTP/2] [5] [:authority: developer.mozilla.org]
• [HTTP/2] [5] [:path: /favicon.svg]
• [HTTP/2] [5] [accept: /]
• [HTTP/2] [5] [accept-encoding: deflate, gzip, br, zstd]
• [HTTP/2] [5] [user-agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0]

GET /favicon.svg HTTP/2
Host: developer.mozilla.org
Accept: /
Accept-Encoding: deflate, gzip, br, zstd
User-Agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0

• Request completely sent off
• RESOLVE developer.mozilla.org:443 - old addresses discarded
• Added developer.mozilla.org:443:2600:1901:0:ab4c::,34.111.97.67 to DNS cache
• Multiplexed connection found
• Re-using existing https: connection with host developer.mozilla.org
• [HTTP/2] [7] OPENED stream for https://developer.mozilla.org/static/media/Inter.var.c2fe3cb2b7c746f7966a.woff2
• [HTTP/2] [7] [:method: GET]
• [HTTP/2] [7] [:scheme: https]
• [HTTP/2] [7] [:authority: developer.mozilla.org]
• [HTTP/2] [7] [:path: /static/media/Inter.var.c2fe3cb2b7c746f7966a.woff2]
• [HTTP/2] [7] [accept: /]
• [HTTP/2] [7] [accept-encoding: deflate, gzip, br, zstd]
• [HTTP/2] [7] [user-agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0]

GET /static/media/Inter.var.c2fe3cb2b7c746f7966a.woff2 HTTP/2
Host: developer.mozilla.org
Accept: /
Accept-Encoding: deflate, gzip, br, zstd
User-Agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0

• Request completely sent off
• RESOLVE developer.mozilla.org:443 - old addresses discarded
• Added developer.mozilla.org:443:2600:1901:0:ab4c::,34.111.97.67 to DNS cache
• Multiplexed connection found
• Re-using existing https: connection with host developer.mozilla.org
• [HTTP/2] [9] OPENED stream for https://developer.mozilla.org/static/js/main.ea244e48.js
• [HTTP/2] [9] [:method: GET]
• [HTTP/2] [9] [:scheme: https]
• [HTTP/2] [9] [:authority: developer.mozilla.org]
• [HTTP/2] [9] [:path: /static/js/main.ea244e48.js]
• [HTTP/2] [9] [accept-encoding: deflate, gzip, br, zstd]
• [HTTP/2] [9] [user-agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0]
• [HTTP/2] [9] [accept: /]
• [HTTP/2] [9] [accept-language: en]
• [HTTP/2] [9] [sec-fetch-dest: script]
• [HTTP/2] [9] [sec-fetch-mode: no-cors]
• [HTTP/2] [9] [sec-fetch-site: same-origin]
• [HTTP/2] [9] [referer: https://developer.mozilla.org/en-US/]

GET /static/js/main.ea244e48.js HTTP/2
Host: developer.mozilla.org
Accept-Encoding: deflate, gzip, br, zstd
User-Agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0
Accept: /
Accept-Language: en
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Referer: https://developer.mozilla.org/en-US/

• Request completely sent off
• RESOLVE developer.mozilla.org:443 - old addresses discarded
• Added developer.mozilla.org:443:2600:1901:0:ab4c::,34.111.97.67 to DNS cache
• Multiplexed connection found
• Re-using existing https: connection with host developer.mozilla.org
• [HTTP/2] [11] OPENED stream for https://developer.mozilla.org/static/css/main.c76af346.css
• [HTTP/2] [11] [:method: GET]
• [HTTP/2] [11] [:scheme: https]
• [HTTP/2] [11] [:authority: developer.mozilla.org]
• [HTTP/2] [11] [:path: /static/css/main.c76af346.css]
• [HTTP/2] [11] [accept-encoding: deflate, gzip, br, zstd]
• [HTTP/2] [11] [user-agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0]
• [HTTP/2] [11] [accept: text/css,/;q=0.1]
• [HTTP/2] [11] [accept-language: en]
• [HTTP/2] [11] [sec-fetch-dest: style]
• [HTTP/2] [11] [sec-fetch-mode: no-cors]
• [HTTP/2] [11] [sec-fetch-site: same-origin]
• [HTTP/2] [11] [referer: https://developer.mozilla.org/en-US/]

GET /static/css/main.c76af346.css HTTP/2
Host: developer.mozilla.org
Accept-Encoding: deflate, gzip, br, zstd
User-Agent: Mozilla/5.0 (macOS; AArch64) Ladybird/1.0
Accept: text/css,/;q=0.1
Accept-Language: en
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Referer: https://developer.mozilla.org/en-US/

• Request completely sent off
  (snip)