net/http: configurable error message for Client sent an HTTP request to an HTTPS server. #49310

mzky · 2021-11-03T09:40:21Z

What version of Go are you using (`go version`)?

$ go version
go version go1.17.2 linux/amd64

Does this issue reproduce with the latest release?

yes.

What operating system and processor architecture are you using (`go env`)?

go env Output

$ go env
GO111MODULE="on"
GOARCH="amd64"
GOBIN=""
GOCACHE="/root/.cache/go-build"
GOENV="/root/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/root/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/root/go"
GOPRIVATE=""
GOPROXY="https://goproxy.cn"
GOROOT="/var/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/var/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.17.2"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/root/go/src/net/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1909543103=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Start the HTTPS service written in golang, and the user accesses the HTTP address.

What did you expect to see?

Display localized language information or customize html page or automatically jump to https address.

What did you see instead?

Chrome and Firefox:
display the following information
Other browsers:
The IE browser prompts a 400 error, and the instructional content is not displayed.
Browsers using the Chromium kernel do not display any visible content.

Users will not be able to understand the current situation.

P.S.
Adding custom options to net/http can solve this problem:
https://github.com/mzky/go/blob/dev.boringcrypto.go1.17/src/net/http/server.go
./make.bash verification is normal

P.P.S.
Use reference:

var tlsBadRequest := `HTTP/1.1 301 Moved Permanently

<!DOCTYPE html>
<html><head><meta charset="UTF-8">
<title>Automatically jump to HTTPS</title
<script type="text/javascript">url = window.location.href.replace("http:", "https:");window.location.replace(url);</script>
</head>
<body></body>
</html>`

http.ListenAndServeTLS2(addr, serverPem, serverKey, tlsBadRequest, Handler)

The text was updated successfully, but these errors were encountered:

thanm · 2021-11-03T18:32:07Z

Thanks for raising the issue.

From my read this sounds more like a feature request as opposed to a bug, correct?

@neild

neild · 2021-11-03T20:08:00Z

The feature request is to respond to an HTTP request on an HTTPS port with a configurable error message.

Testing several major websites (www.google.com, www.amazon.com, www.microsoft.com), none of them respond with an error message to an HTTP request on port 443. Two close the connection without response, one leaves the connection open but does not respond.

I have not checked any other HTTPS server implementations (Apache, nginx, etc.) to see how they handle this condition. It would be interesting to know if any attempt to report an error to the peer in this case.

In the absence of evidence that this is a common feature, I don't think we should add this.

mzky · 2021-11-04T01:30:49Z

Hi ! This is a feature request, not a bug.

I found some examples of Nginx configuring HTTP redirection to HTTPS：https://linuxize.com/post/redirect-http-to-https-in-nginx/

Old version Parameters：
···
rewrite ^(.*)$ https://$host$1 permanent;
···
New version Parameters：
···
return 301 https://$server_name$request_uri;
···

I want to replace nginx's auto-jump feature with Golang.
Of course, this is just a suggestion, the changes will not affect the original functions.

seankhliao · 2021-11-04T10:59:52Z

HTTP redirection is different from the filed issue. It's already possible by listening on both HTTP and HTTPS ports and handling the redirection within the handlers

go http.ListenAndServe(":80", http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
        // handle redirect here
}))
http.ListenAndServeTLS(":443", "...", "...", nil)

mzky · 2021-11-05T01:00:31Z

HTTP redirection is different from the filed issue. It's already possible by listening on both HTTP and HTTPS ports and handling the redirection within the handlers
go http.ListenAndServe(":80", http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
        // handle redirect here
}))
http.ListenAndServeTLS(":443", "...", "...", nil)

Yes, different port forwarding is also possible, but I need a forwarding on the same port

mzky · 2021-11-15T06:08:10Z

They all jump to https with the same port:

mzky · 2021-11-15T06:27:02Z

Go language simulates google：

neild · 2021-11-15T18:02:07Z

They all jump to https with the same port:

An https:// URL with no port uses a default port of 443, not 80. All these are redirecting from HTTP on port 80 to HTTPS on port 443.

hktalent · 2023-03-06T09:28:14Z

I would also like to make some comments on this issue

First of all, since the server can output "Client send an HTTP request to an HTTPS server", it should give the control of the output to the developer instead of burying him deeply
Secondly, to solve this problem, we should not use nginx or listen to port 80 more, which are very cumbersome

hktalent · 2023-08-30T00:50:16Z

Yes, any core modifications don't seem to be standard-compliant, but, that's the truth, we need a way to intercept when "Client send an HTTP request to an HTTPS server" happens, or have a kind of friendly wrapper that allows him to Controllable output, because "Client send an HTTP request to an HTTPS server" directly output to the browser is very unfriendly, and it is uncontrollable and unexpected

mzky changed the title ~~net/http It is recommended to add an optional https downgrade access prompt~~ net/http: It is recommended to add an optional https downgrade access prompt Nov 3, 2021

thanm added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Nov 3, 2021

thanm added this to the Backlog milestone Nov 3, 2021

seankhliao changed the title ~~net/http: It is recommended to add an optional https downgrade access prompt~~ net/http: configurable error message for Client sent an HTTP request to an HTTPS server. Feb 8, 2022

net/http: configurable error message for Client sent an HTTP request to an HTTPS server. #49310

net/http: configurable error message for Client sent an HTTP request to an HTTPS server. #49310

mzky commented Nov 3, 2021 •

edited

thanm commented Nov 3, 2021

neild commented Nov 3, 2021

mzky commented Nov 4, 2021

seankhliao commented Nov 4, 2021

mzky commented Nov 5, 2021

mzky commented Nov 15, 2021 •

edited

mzky commented Nov 15, 2021 •

edited

neild commented Nov 15, 2021

hktalent commented Mar 6, 2023

hktalent commented Aug 30, 2023

net/http: configurable error message for Client sent an HTTP request to an HTTPS server. #49310

net/http: configurable error message for Client sent an HTTP request to an HTTPS server. #49310

Comments

mzky commented Nov 3, 2021 • edited

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

What did you do?

What did you expect to see?

What did you see instead?

thanm commented Nov 3, 2021

neild commented Nov 3, 2021

mzky commented Nov 4, 2021

seankhliao commented Nov 4, 2021

mzky commented Nov 5, 2021

mzky commented Nov 15, 2021 • edited

mzky commented Nov 15, 2021 • edited

neild commented Nov 15, 2021

hktalent commented Mar 6, 2023

hktalent commented Aug 30, 2023

mzky commented Nov 3, 2021 •

edited

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?

mzky commented Nov 15, 2021 •

edited

mzky commented Nov 15, 2021 •

edited