curl uses http/1.1 alpn code when told to use http/1.0

[programmerlexi]

I did this

1. I started a local https server on port 8000.
2. I sent a request using curl --http1.0 -vvv --insecure https://localhost:8000
3. Curl offers http/1.1 via ALPN
4. Curl sends a http/1.0 request

I expected the following

Curl should offer http/1.0 via ALPN instead of http/1.1 as http/1.0 was specified via the command line and the send request was also http/1.0

curl/libcurl version

curl 8.17.0 (x86_64-pc-linux-gnu) libcurl/8.17.0 OpenSSL/3.6.0 zlib/1.3.1 brotli/1.2.0 zstd/1.5.7 libidn2/2.3.8 libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.67.1 ngtcp2/1.18.0 nghttp3/1.13.1 mit-krb5/1.22.1
Release-Date: 2025-11-05
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd

operating system

Linux nixie-tube 6.18.5-zen1 #1-NixOS ZEN SMP PREEMPT_DYNAMIC Tue Jan 1 00:00:00 UTC 1980 x86_64 GNU/Linux

[jay]

Curl should offer http/1.0 via ALPN instead of http/1.1 as http/1.0 was specified via the command line and the send request was also http/1.0

Ref: #12259
Ref: https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids

curl uses ALPN http/1.1 for HTTP/1.0 requests for compatibility reasons.

curl/lib/vtls/vtls.c

Lines 150 to 170 in 2eebc58

	static const struct alpn_spec *alpn_get_spec(http_majors wanted,
	http_majors preferred,
	bool use_alpn)
	{
	if(!use_alpn)
	return NULL;
	#ifdef USE_HTTP2
	if(wanted & CURL_HTTP_V2x) {
	if(wanted & CURL_HTTP_V1x)
	return (preferred == CURL_HTTP_V1x) ?
	&ALPN_SPEC_H11_H2 : &ALPN_SPEC_H2_H11;
	return &ALPN_SPEC_H2;
	}
	#else
	(void)wanted;
	(void)preferred;
	#endif
	/* Use the ALPN protocol "http/1.1" for HTTP/1.x.
	Avoid "http/1.0" because some servers do not support it. */
	return &ALPN_SPEC_H11;
	}

[bagder]

@programmerlexi is this actually causing a problem for you?

[programmerlexi]

This doesn't cause much of an issue, but i feel it's incorrect to exclusively offer HTTP/1.1 for a HTTP/1.0 connection.
I feel like curl should at least offer HTTP/1.0 as the preferred protocol when --http1.0 is used.

[icing]

This doesn't cause much of an issue, but i feel it's incorrect to exclusively offer HTTP/1.1 for a HTTP/1.0 connection. I feel like curl should at least offer HTTP/1.0 as the preferred protocol when --http1.0 is used.

Do you know of a server that implements this ALPN (apart from the fact that ALPN http/1.0 is not a registered identifier)? Apache does not. And what should a server do then? Reject an incoming HTTP/1.1 request on such a connection? I do not see anyone implementing this.

[programmerlexi]

Do you know of a server that implements this ALPN (apart from the fact that ALPN http/1.0 is not a registered identifier)?

I am currently implementing a server that does.
http/1.0 it is a registered identifier in the registry.

And what should a server do then? Reject an incoming HTTP/1.1 request on such a connection?

Yes.

[icing]

Ah, ok. They added it since the last time I looked. Hmm...not sure I see the benefit of such...but you are of course free to implement such a server.

[jay]

I think for HTTP/1.0 requests we should keep sending ALPN http/1.1 for compatibility reasons, however we could also send ALPN http/1.0 for servers that accept only that. In other words send both, see #20533.

[jay]

Thanks. For HTTP/1.0 requests curl will now send ALPNs http/1.0 and http/1.1 and the server can pick which one it recognizes.