diff --git a/src/Servers/Kestrel/Core/src/Internal/Http2/Http2Connection.cs b/src/Servers/Kestrel/Core/src/Internal/Http2/Http2Connection.cs index 5585c23ef377..58de076a029f 100644 --- a/src/Servers/Kestrel/Core/src/Internal/Http2/Http2Connection.cs +++ b/src/Servers/Kestrel/Core/src/Internal/Http2/Http2Connection.cs @@ -1059,8 +1059,12 @@ private Task ProcessWindowUpdateFrameAsync() { if (stream.RstStreamReceived) { - // Hard abort, do not allow any more frames on this stream. - throw new Http2ConnectionErrorException(CoreStrings.FormatHttp2ErrorStreamAborted(_incomingFrame.Type, stream.StreamId), Http2ErrorCode.STREAM_CLOSED); + // WINDOW_UPDATE received after we have already processed an inbound RST_STREAM for this stream. + // RFC 7540 (Sections 5.1, 6.9) / RFC 9113 do not explicitly define semantics for WINDOW_UPDATE on a + // stream in the "closed" state due to a reset by client. We surface it as a stream error (STREAM_CLOSED) + // rather than aborting the entire connection to keep behavior deterministic and consistent with other servers. + // https://github.com/dotnet/aspnetcore/issues/63726 + throw new Http2StreamErrorException(_incomingFrame.StreamId, CoreStrings.Http2StreamAborted, Http2ErrorCode.STREAM_CLOSED); } if (!stream.TryUpdateOutputWindow(_incomingFrame.WindowUpdateSizeIncrement)) diff --git a/src/Servers/Kestrel/test/InMemory.FunctionalTests/Http2/Http2ConnectionTests.cs b/src/Servers/Kestrel/test/InMemory.FunctionalTests/Http2/Http2ConnectionTests.cs index 7e5cec61fa81..5b2fbaf46e62 100644 --- a/src/Servers/Kestrel/test/InMemory.FunctionalTests/Http2/Http2ConnectionTests.cs +++ b/src/Servers/Kestrel/test/InMemory.FunctionalTests/Http2/Http2ConnectionTests.cs @@ -3355,10 +3355,12 @@ public async Task RST_STREAM_IncompleteRequest_AdditionalWindowUpdateFrame_Conne await SendDataAsync(1, new byte[1], endStream: false); await SendRstStreamAsync(1); await SendWindowUpdateAsync(1, 1024); - tcs.TrySetResult(); - await WaitForConnectionErrorAsync(ignoreNonGoAwayFrames: false, expectedLastStreamId: 1, - Http2ErrorCode.STREAM_CLOSED, CoreStrings.FormatHttp2ErrorStreamAborted(Http2FrameType.WINDOW_UPDATE, 1)); + await WaitForStreamErrorAsync(expectedStreamId: 1, Http2ErrorCode.STREAM_CLOSED, CoreStrings.Http2StreamAborted); + + tcs.TrySetResult(); // Don't let the response start until after the abort + + await StopConnectionAsync(expectedLastStreamId: 1, ignoreNonGoAwayFrames: false); } [Fact]