Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

http: remove legacy parser #29589

Closed
wants to merge 1 commit into from

Conversation

@addaleax
Copy link
Member

addaleax commented Sep 17, 2019

Remove the legacy http_parser implementation as a dependency
and all code that uses it in favor of llhttp, given that the latter
has been the default for all of Node 12 with no outstanding issues.


I think one of the ideas behind making llhttp the default for v12.x is that that means that we could drop http_parser for Node 12 LTS, reducing the time that it needs to be supported. In that case, this should probably land soon-ish. I’m personally also okay with landing this before or after Node 13 only, if people prefer that.

@nodejs/tsc @nodejs/http

Checklist
  • make -j4 test (UNIX), or vcbuild test (Windows) passes
  • tests and/or benchmarks are included
  • documentation is changed or added
  • commit message follows commit guidelines
@addaleax addaleax force-pushed the addaleax:remove-legacy-http-parser branch from 8ec188b to d9adf95 Sep 17, 2019
@nodejs-github-bot

This comment has been minimized.

Copy link
Member

mcollina left a comment

LGTM

I think this is semver-major.

@addaleax

This comment has been minimized.

Copy link
Member Author

addaleax commented Sep 17, 2019

I think this is semver-major.

@mcollina Do you mind explaining why? This doesn’t come with API changes, neither for the http module nor CLI flags, it only changes llhttp from being the default to being always-on.

@mcollina

This comment has been minimized.

Copy link
Member

mcollina commented Sep 17, 2019

We used to have a flag to switch between the two, have you removed that?

@addaleax

This comment has been minimized.

Copy link
Member Author

addaleax commented Sep 17, 2019

@mcollina It’s turned into a no-op here in order to make this as un-breaking as possible :)

@mcollina

This comment has been minimized.

Copy link
Member

mcollina commented Sep 17, 2019

@mcollina It’s turned into a no-op here in order to make this as un-breaking as possible :)

If somebody is relying on the legacy parser behavior, this would break them. I think it's better to remove the flag and call it semver-major.

@addaleax

This comment has been minimized.

Copy link
Member Author

addaleax commented Sep 17, 2019

If somebody is relying on the legacy parser behaviour in some way, then yes, this is semver-major – I’d consider the chances of that actually being the case pretty slim, though.

I wouldn’t want to remove the flag in this PR either way. (Honestly, I personally wouldn’t want to remove any flags that can reasonably be turned into no-ops, ever.) That can happen later and seems like a different concern to me.

@addaleax

This comment has been minimized.

Copy link
Member Author

addaleax commented Sep 17, 2019

Anyway, if you think this is semver-major, feel free to add the label. As the PR description says, I’m fine with that, even if I don’t think it’s necessary.

@mcollina

This comment has been minimized.

Copy link
Member

mcollina commented Sep 17, 2019

I'm tagging this tsc-agenda, just to poll the @nodejs/tsc. If the TSC has no objection, I'm happy for a semver-minor.

@mcollina mcollina added the tsc-agenda label Sep 17, 2019
@sam-github

This comment has been minimized.

Copy link
Member

sam-github commented Sep 17, 2019

I think removing a feature is semver-major, so removing http_parser is semver-major. There have been differences between parsers noticed in the past, being careful here seems a good thing to me.

Removing the CLI option would also be semver-major, even if it is a no-op.

Working around different CLI options for different node.js versions is difficult, so I'm in favour of leaving the CLI option to select the http_parser around even after the parser is gone, though perhaps it should print a warning saying that it isn't actually doing anything?

@jasnell

This comment has been minimized.

Copy link
Member

jasnell commented Sep 17, 2019

hmm... tough one. I can see your rationale on this for semver-minor @addaleax. That said, our deprecation policy requires that End-of-life transitions are semver-major, and there's a likely-very-small-but-still-non-zero possibility that someone is building a native addon somewhere that depends on the presence of the http_parser.h headers, regardless of whether they are depending on any of the actual behaviors implemented. I think to be safe we have to consider this a semver-major change.

@jasnell

This comment has been minimized.

Copy link
Member

jasnell commented Sep 17, 2019

Marking semver-major for now, but this should definitely be discussed on the TSC meeting.

@Trott Trott force-pushed the nodejs:master branch from 1ecc406 to 49cf67e Sep 17, 2019
@lpinca
lpinca approved these changes Sep 17, 2019
Copy link
Member

lpinca left a comment

RSLGTM

@lpinca

This comment has been minimized.

Copy link
Member

lpinca commented Sep 17, 2019

There seem to be a spurious commit was this done on purpose?

Copy link
Member

jasnell left a comment

LGTM as a semver-major (and with the extraneous commit removed)

Remove the legacy `http_parser` implementation as a dependency
and all code that uses it in favor of llhttp, given that the latter
has been the default for all of Node 12 with no outstanding issues.
@addaleax addaleax force-pushed the addaleax:remove-legacy-http-parser branch from d9adf95 to 1f86ad0 Sep 17, 2019
@addaleax

This comment has been minimized.

Copy link
Member Author

addaleax commented Sep 17, 2019

I think removing a feature is semver-major, so removing http_parser is semver-major.

I don’t think this qualifies as a feature, it’s a change in implementation details. The only question is whether it’s a big enough one to have to be more careful than usual here.

There seem to be a spurious commit was this done on purpose?

That seems to be @Trott rebasing nodejs/master. I’ve rebased this against master again, the extra commit is gone.

That said, our deprecation policy requires that End-of-life transitions are semver-major

(I don’t really understand why this was deprecated, either.)

and there's a likely-very-small-but-still-non-zero possibility that someone is building a native addon somewhere that depends on the presence of the http_parser.h headers, regardless of whether they are depending on any of the actual behaviors implemented.

We don’t publish the http parser headers along with Node, and we don’t re-export the symbols on Windows. I think it’s safe to say that this isn’t a concern here.

@jasnell

This comment has been minimized.

Copy link
Member

jasnell commented Sep 17, 2019

We don’t publish the http parser headers along with Node, and we don’t re-export the symbols on Windows. I think it’s safe to say that this isn’t a concern here.

👍

Ok, well, I'm good with the change overall. If there are no objections from the rest of the TSC on dropping the semver-major on this, then I'm good with that also, but as it is right now because of the deprecation it's technically semver-major :-/

@addaleax

This comment has been minimized.

Copy link
Member Author

addaleax commented Sep 18, 2019

@nodejs/tsc Trying to give a tl;dr for those in the meeting later:

The question is whether we should consider this PR semver-major and what release lines we should land it on. This PR makes the llhttp parser, which is the default HTTP parser in Node 12, the only one available and turns the switch for changing to the legacy parser into a no-op.

There have been 2 bug reports (#28137 and #27584) about behavioral changes since the release of Node 12.0.0 reported with llhttp which are fixed by now, and no new ones reported in the last 3 months.

The downside to landing this in Node 12 is that, should there be more bugs of that kind, we cannot provide switching to the legacy parser as a workaround. The upside is that it means having to support the legacy parser for one year less, including security issues if they arise.

This PR does not change APIs beyond turning off the CLI switch, and the legacy parser and llhttp aim to provide the same behaviour. I see a point in arguing that a sufficiently big change in implementation details is something that should be considered semver-major, especially if there have been accounts of differences in the past. It seems like @sam-github, @mcollina and @jasnell lean towards or are in favor of marking this semver-major.

@nodejs-github-bot

This comment has been minimized.

@addaleax addaleax added author ready and removed tsc-agenda labels Sep 18, 2019
@jasnell

This comment has been minimized.

Copy link
Member

jasnell commented Sep 18, 2019

I would say that by policy it's semver-major, but if the TSC is fine with it not being major, then I'm fine with that also

@addaleax

This comment has been minimized.

Copy link
Member Author

addaleax commented Sep 18, 2019

In the TSC meeting, the consensus was that we do land this PR as semver-major, and anybody would be free to open a PR against v12.x that adds a runtime deprecation warning for --http-parser=legacy that states that the legacy parser may go away if there are security issues with it.

Copy link
Member

trivikr left a comment

RSLGTM

addaleax added a commit that referenced this pull request Sep 20, 2019
Remove the legacy `http_parser` implementation as a dependency
and all code that uses it in favor of llhttp, given that the latter
has been the default for all of Node 12 with no outstanding issues.

PR-URL: #29589
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Minwoo Jung <minwoo@nodesource.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
@addaleax

This comment has been minimized.

Copy link
Member Author

addaleax commented Sep 20, 2019

Landed in ac59dc4 🎉

@addaleax addaleax closed this Sep 20, 2019
@addaleax addaleax deleted the addaleax:remove-legacy-http-parser branch Sep 20, 2019
BethGriggs added a commit that referenced this pull request Oct 21, 2019
Notable changes:

- **assert**:
    - do not repeat .throws() code (Ruben Bridgewater)
        [#28263](#28263)
    - wrap validation function errors (Ruben Bridgewater)
        [#28263](#28263)
    - fix generatedMessage property (Ruben Bridgewater)
        [#28263](#28263)
    - improve class instance errors (Ruben Bridgewater)
        [#28263](#28263)
- **benchmark**:
    - use test/common/tmpdir consistently (João Reis)
        [#28858](#28858)
- **build**:
    - make full-icu the default for releases (Richard Lau)
        [#29887](#29887)
    - update minimum Xcode version for macOS (Michael Dawson)
        [#29622](#29622)
- **child_process**:
    - runtime deprecate \_channel (cjihrig)
        [#27949](#27949)
    - simplify spawn argument parsing (cjihrig)
        [#27854](#27854)
- **console**:
    - display timeEnd with suitable time unit (Xavier Stouder)
        [#29251](#29251)
- **deps**:
    - patch V8 to 7.8.279.14 (Myles Borins)
        [#29694](#29694)
    - patch V8 to 7.8.279.12 (Myles Borins)
        [#29694](#29694)
    - patch V8 to 7.8.279.10 (Myles Borins)
        [#29694](#29694)
    - update V8's postmortem script (cjihrig)
        [#29694](#29694)
    - V8: cherry-pick 716875d (Myles Borins)
        [#29694](#29694)
    - update V8 to 7.8.279.9 (Myles Borins)
        [#29694](#29694)
    - V8: cherry-pick b33af60 (Michaël Zasso)
        [#28016](#28016)
    - update V8 to 7.6.303.28 (Michaël Zasso)
        [#28016](#28016)
- **domain**:
    - error handler runs outside of its domain (Julien Gilli)
        [#26211](#26211)
- **fs**:
    - make FSWatcher.start private (Lucas Holmquist)
        [#29905](#29905)
    - add runtime deprecate for file stream open() (Robert Nagy)
    [#29061](#29061)
    - allow int64 offset in fs.write/writeSync/fd.write (Zach Bjornson)
    [#26572](#26572)
    - use IsSafeJsInt instead of IsNumber for ftruncate (Zach Bjornson)
    [#26572](#26572)
    - allow int64 offset in fs.read/readSync/fd.read (Zach Bjornson)
    [#26572](#26572)
    - close file descriptor of promisified truncate (João Reis)
    [#28858](#28858)
- **http**:
    - do not emit end after aborted (Robert Nagy)
        [#27984](#27984)
    - don't emit 'data' after 'error' (Robert Nagy)
        [#28711](#28711)
    - remove legacy parser (Anna Henningsen)
        [#29589](#29589)
    - throw if 'host' agent header is not a string value
        (Giorgos Ntemiris)
        [#29568](#29568)
    - replace superfluous connection property with getter/setter
        (Robert Nagy)
        [#29015](#29015)
    - fix test where aborted should not be emitted (Robert Nagy)
        [#20077](#20077)
    - remove default 'timeout' listener on upgrade (Luigi Pinca)
        [#26030](#26030)
- **http, http2**:
    - remove default server timeout (Ali Ijaz Sheikh)
        [#27558](#27558)
- **http2**:
    - remove security revert flags (Anna Henningsen)
        [#29141](#29141)
    - remove callback-based padding (Anna Henningsen)
        [#29144](#29144)
- **lib**:
    - rename validateInteger to validateSafeInteger (Zach Bjornson)
        [#26572](#26572)
    - correct error.errno to always be numeric (Joyee Cheung)
        [#28140](#28140)
    - no need to strip BOM or shebang for scripts (Refael Ackermann)
        [#27375](#27375)
    - rework logic of stripping BOM+Shebang from commonjs (Gus Caplan)
        [#27768](#27768)
- **module**:
    - runtime deprecate createRequireFromPath() (cjihrig)
        [#27951](#27951)
- **readline**:
    - error on falsy values for callback (Sam Roberts)
        [#28109](#28109)
- **repl**:
    - close file descriptor of history file (João Reis)
        [#28858](#28858)
- **src**:
    - bring 425 status code name into accordance with RFC 8470
        (Sergei Osipov)
        [#29880](#29880)
    - update NODE\_MODULE\_VERSION to 79 (Myles Borins)
        [#29694](#29694)
    - update NODE\_MODULE\_VERSION to 78 (Michaël Zasso)
        [#28918](#28918)
    - add error codes to errors thrown in C++ (Yaniv Friedensohn)
        [#27700](#27700)
    - use non-deprecated overload of V8::SetFlagsFromString
        (Michaël Zasso)
        [#28016](#28016)
    - update NODE\_MODULE\_VERSION to 77 (Michaël Zasso)
        [#28016](#28016)
    - update NODE\_MODULE\_VERSION to 74 (Refael Ackermann)
        [#27375](#27375)
    - make process.env.TZ setter clear tz cache (Ben Noordhuis)
        [#20026](#20026)
    - enable V8's WASM trap handlers (Gus Caplan)
        [#27246](#27246)
- **stream**:
    - throw unhandled error for readable with autoDestroy (Robert Nagy)
        [#29806](#29806)
    - always invoke callback before emitting error (Robert Nagy)
        [#29293](#29293)
    - invoke callback before emitting error always (Robert Nagy)
        [#29293](#29293)
    - do not flush destroyed writable (Robert Nagy)
        [#29028](#29028)
    - don't emit finish on error (Robert Nagy)
        [#28979](#28979)
    - disallow stream methods on finished stream (Robert Nagy)
        [#28687](#28687)
    - do not emit after 'error' (Robert Nagy)
        [#28708](#28708)
    - fix destroy() behavior (Robert Nagy)
        [#29058](#29058)
    - simplify `.pipe()` and `.unpipe()` in Readable (Weijia Wang)
        [#28583](#28583)
- **tools**:
    - patch V8 to run on older XCode versions (Ujjwal Sharma)
        [#29694](#29694)
    - update V8 gypfiles (Michaël Zasso)
        [#29694](#29694)
    - support full-icu by default (Steven R. Loomis)
        [#29522](#29522)
- **util**: validate formatWithOptions inspectOptions
    (Ruben Bridgewater)
    [#29824](#29824)

PR-URL: #29504
BethGriggs added a commit that referenced this pull request Oct 21, 2019
Notable changes:

- **assert**:
    - do not repeat .throws() code (Ruben Bridgewater)
        [#28263](#28263)
    - wrap validation function errors (Ruben Bridgewater)
        [#28263](#28263)
    - fix generatedMessage property (Ruben Bridgewater)
        [#28263](#28263)
    - improve class instance errors (Ruben Bridgewater)
        [#28263](#28263)
- **benchmark**:
    - use test/common/tmpdir consistently (João Reis)
        [#28858](#28858)
- **build**:
    - make full-icu the default for releases (Richard Lau)
        [#29887](#29887)
    - update minimum Xcode version for macOS (Michael Dawson)
        [#29622](#29622)
- **child_process**:
    - runtime deprecate \_channel (cjihrig)
        [#27949](#27949)
    - simplify spawn argument parsing (cjihrig)
        [#27854](#27854)
- **console**:
    - display timeEnd with suitable time unit (Xavier Stouder)
        [#29251](#29251)
- **deps**:
    - patch V8 to 7.8.279.14 (Myles Borins)
        [#29694](#29694)
    - patch V8 to 7.8.279.12 (Myles Borins)
        [#29694](#29694)
    - patch V8 to 7.8.279.10 (Myles Borins)
        [#29694](#29694)
    - update V8's postmortem script (cjihrig)
        [#29694](#29694)
    - V8: cherry-pick 716875d (Myles Borins)
        [#29694](#29694)
    - update V8 to 7.8.279.9 (Myles Borins)
        [#29694](#29694)
    - V8: cherry-pick b33af60 (Michaël Zasso)
        [#28016](#28016)
    - update V8 to 7.6.303.28 (Michaël Zasso)
        [#28016](#28016)
- **domain**:
    - error handler runs outside of its domain (Julien Gilli)
        [#26211](#26211)
- **fs**:
    - make FSWatcher.start private (Lucas Holmquist)
        [#29905](#29905)
    - add runtime deprecate for file stream open() (Robert Nagy)
    [#29061](#29061)
    - allow int64 offset in fs.write/writeSync/fd.write (Zach Bjornson)
    [#26572](#26572)
    - use IsSafeJsInt instead of IsNumber for ftruncate (Zach Bjornson)
    [#26572](#26572)
    - allow int64 offset in fs.read/readSync/fd.read (Zach Bjornson)
    [#26572](#26572)
    - close file descriptor of promisified truncate (João Reis)
    [#28858](#28858)
- **http**:
    - do not emit end after aborted (Robert Nagy)
        [#27984](#27984)
    - don't emit 'data' after 'error' (Robert Nagy)
        [#28711](#28711)
    - remove legacy parser (Anna Henningsen)
        [#29589](#29589)
    - throw if 'host' agent header is not a string value
        (Giorgos Ntemiris)
        [#29568](#29568)
    - replace superfluous connection property with getter/setter
        (Robert Nagy)
        [#29015](#29015)
    - fix test where aborted should not be emitted (Robert Nagy)
        [#20077](#20077)
    - remove default 'timeout' listener on upgrade (Luigi Pinca)
        [#26030](#26030)
- **http, http2**:
    - remove default server timeout (Ali Ijaz Sheikh)
        [#27558](#27558)
- **http2**:
    - remove security revert flags (Anna Henningsen)
        [#29141](#29141)
    - remove callback-based padding (Anna Henningsen)
        [#29144](#29144)
- **lib**:
    - rename validateInteger to validateSafeInteger (Zach Bjornson)
        [#26572](#26572)
    - correct error.errno to always be numeric (Joyee Cheung)
        [#28140](#28140)
    - no need to strip BOM or shebang for scripts (Refael Ackermann)
        [#27375](#27375)
    - rework logic of stripping BOM+Shebang from commonjs (Gus Caplan)
        [#27768](#27768)
- **module**:
    - runtime deprecate createRequireFromPath() (cjihrig)
        [#27951](#27951)
- **readline**:
    - error on falsy values for callback (Sam Roberts)
        [#28109](#28109)
- **repl**:
    - close file descriptor of history file (João Reis)
        [#28858](#28858)
- **src**:
    - bring 425 status code name into accordance with RFC 8470
        (Sergei Osipov)
        [#29880](#29880)
    - update NODE\_MODULE\_VERSION to 79 (Myles Borins)
        [#29694](#29694)
    - update NODE\_MODULE\_VERSION to 78 (Michaël Zasso)
        [#28918](#28918)
    - add error codes to errors thrown in C++ (Yaniv Friedensohn)
        [#27700](#27700)
    - use non-deprecated overload of V8::SetFlagsFromString
        (Michaël Zasso)
        [#28016](#28016)
    - update NODE\_MODULE\_VERSION to 77 (Michaël Zasso)
        [#28016](#28016)
    - update NODE\_MODULE\_VERSION to 74 (Refael Ackermann)
        [#27375](#27375)
    - make process.env.TZ setter clear tz cache (Ben Noordhuis)
        [#20026](#20026)
    - enable V8's WASM trap handlers (Gus Caplan)
        [#27246](#27246)
- **stream**:
    - throw unhandled error for readable with autoDestroy (Robert Nagy)
        [#29806](#29806)
    - always invoke callback before emitting error (Robert Nagy)
        [#29293](#29293)
    - invoke callback before emitting error always (Robert Nagy)
        [#29293](#29293)
    - do not flush destroyed writable (Robert Nagy)
        [#29028](#29028)
    - don't emit finish on error (Robert Nagy)
        [#28979](#28979)
    - disallow stream methods on finished stream (Robert Nagy)
        [#28687](#28687)
    - do not emit after 'error' (Robert Nagy)
        [#28708](#28708)
    - fix destroy() behavior (Robert Nagy)
        [#29058](#29058)
    - simplify `.pipe()` and `.unpipe()` in Readable (Weijia Wang)
        [#28583](#28583)
- **tools**:
    - patch V8 to run on older XCode versions (Ujjwal Sharma)
        [#29694](#29694)
    - update V8 gypfiles (Michaël Zasso)
        [#29694](#29694)
    - support full-icu by default (Steven R. Loomis)
        [#29522](#29522)
- **util**: validate formatWithOptions inspectOptions
    (Ruben Bridgewater)
    [#29824](#29824)

PR-URL: #29504
BethGriggs added a commit that referenced this pull request Oct 21, 2019
Notable changes:

- **assert**:
    - do not repeat .throws() code (Ruben Bridgewater)
        [#28263](#28263)
    - wrap validation function errors (Ruben Bridgewater)
        [#28263](#28263)
    - fix generatedMessage property (Ruben Bridgewater)
        [#28263](#28263)
    - improve class instance errors (Ruben Bridgewater)
        [#28263](#28263)
- **benchmark**:
    - use test/common/tmpdir consistently (João Reis)
        [#28858](#28858)
- **build**:
    - make full-icu the default for releases (Richard Lau)
        [#29887](#29887)
    - update minimum Xcode version for macOS (Michael Dawson)
        [#29622](#29622)
- **child_process**:
    - runtime deprecate \_channel (cjihrig)
        [#27949](#27949)
    - simplify spawn argument parsing (cjihrig)
        [#27854](#27854)
- **console**:
    - display timeEnd with suitable time unit (Xavier Stouder)
        [#29251](#29251)
- **deps**:
    - patch V8 to 7.8.279.14 (Myles Borins)
        [#29694](#29694)
    - patch V8 to 7.8.279.12 (Myles Borins)
        [#29694](#29694)
    - patch V8 to 7.8.279.10 (Myles Borins)
        [#29694](#29694)
    - update V8's postmortem script (cjihrig)
        [#29694](#29694)
    - V8: cherry-pick 716875d (Myles Borins)
        [#29694](#29694)
    - update V8 to 7.8.279.9 (Myles Borins)
        [#29694](#29694)
    - V8: cherry-pick b33af60 (Michaël Zasso)
        [#28016](#28016)
    - update V8 to 7.6.303.28 (Michaël Zasso)
        [#28016](#28016)
- **domain**:
    - error handler runs outside of its domain (Julien Gilli)
        [#26211](#26211)
- **fs**:
    - make FSWatcher.start private (Lucas Holmquist)
        [#29905](#29905)
    - add runtime deprecate for file stream open() (Robert Nagy)
    [#29061](#29061)
    - allow int64 offset in fs.write/writeSync/fd.write (Zach Bjornson)
    [#26572](#26572)
    - use IsSafeJsInt instead of IsNumber for ftruncate (Zach Bjornson)
    [#26572](#26572)
    - allow int64 offset in fs.read/readSync/fd.read (Zach Bjornson)
    [#26572](#26572)
    - close file descriptor of promisified truncate (João Reis)
    [#28858](#28858)
- **http**:
    - do not emit end after aborted (Robert Nagy)
        [#27984](#27984)
    - don't emit 'data' after 'error' (Robert Nagy)
        [#28711](#28711)
    - remove legacy parser (Anna Henningsen)
        [#29589](#29589)
    - throw if 'host' agent header is not a string value
        (Giorgos Ntemiris)
        [#29568](#29568)
    - replace superfluous connection property with getter/setter
        (Robert Nagy)
        [#29015](#29015)
    - fix test where aborted should not be emitted (Robert Nagy)
        [#20077](#20077)
    - remove default 'timeout' listener on upgrade (Luigi Pinca)
        [#26030](#26030)
- **http, http2**:
    - remove default server timeout (Ali Ijaz Sheikh)
        [#27558](#27558)
- **http2**:
    - remove security revert flags (Anna Henningsen)
        [#29141](#29141)
    - remove callback-based padding (Anna Henningsen)
        [#29144](#29144)
- **lib**:
    - rename validateInteger to validateSafeInteger (Zach Bjornson)
        [#26572](#26572)
    - correct error.errno to always be numeric (Joyee Cheung)
        [#28140](#28140)
    - no need to strip BOM or shebang for scripts (Refael Ackermann)
        [#27375](#27375)
    - rework logic of stripping BOM+Shebang from commonjs (Gus Caplan)
        [#27768](#27768)
- **module**:
    - runtime deprecate createRequireFromPath() (cjihrig)
        [#27951](#27951)
- **readline**:
    - error on falsy values for callback (Sam Roberts)
        [#28109](#28109)
- **repl**:
    - close file descriptor of history file (João Reis)
        [#28858](#28858)
- **src**:
    - bring 425 status code name into accordance with RFC 8470
        (Sergei Osipov)
        [#29880](#29880)
    - update NODE\_MODULE\_VERSION to 79 (Myles Borins)
        [#29694](#29694)
    - update NODE\_MODULE\_VERSION to 78 (Michaël Zasso)
        [#28918](#28918)
    - add error codes to errors thrown in C++ (Yaniv Friedensohn)
        [#27700](#27700)
    - use non-deprecated overload of V8::SetFlagsFromString
        (Michaël Zasso)
        [#28016](#28016)
    - update NODE\_MODULE\_VERSION to 77 (Michaël Zasso)
        [#28016](#28016)
    - update NODE\_MODULE\_VERSION to 74 (Refael Ackermann)
        [#27375](#27375)
    - make process.env.TZ setter clear tz cache (Ben Noordhuis)
        [#20026](#20026)
    - enable V8's WASM trap handlers (Gus Caplan)
        [#27246](#27246)
- **stream**:
    - throw unhandled error for readable with autoDestroy (Robert Nagy)
        [#29806](#29806)
    - always invoke callback before emitting error (Robert Nagy)
        [#29293](#29293)
    - invoke callback before emitting error always (Robert Nagy)
        [#29293](#29293)
    - do not flush destroyed writable (Robert Nagy)
        [#29028](#29028)
    - don't emit finish on error (Robert Nagy)
        [#28979](#28979)
    - disallow stream methods on finished stream (Robert Nagy)
        [#28687](#28687)
    - do not emit after 'error' (Robert Nagy)
        [#28708](#28708)
    - fix destroy() behavior (Robert Nagy)
        [#29058](#29058)
    - simplify `.pipe()` and `.unpipe()` in Readable (Weijia Wang)
        [#28583](#28583)
- **tools**:
    - patch V8 to run on older XCode versions (Ujjwal Sharma)
        [#29694](#29694)
    - update V8 gypfiles (Michaël Zasso)
        [#29694](#29694)
    - support full-icu by default (Steven R. Loomis)
        [#29522](#29522)
- **util**: validate formatWithOptions inspectOptions
    (Ruben Bridgewater)
    [#29824](#29824)

PR-URL: #29504
BethGriggs added a commit that referenced this pull request Oct 22, 2019
Notable changes:

- **assert**:
    - do not repeat .throws() code (Ruben Bridgewater)
        [#28263](#28263)
    - wrap validation function errors (Ruben Bridgewater)
        [#28263](#28263)
    - fix generatedMessage property (Ruben Bridgewater)
        [#28263](#28263)
    - improve class instance errors (Ruben Bridgewater)
        [#28263](#28263)
- **benchmark**:
    - use test/common/tmpdir consistently (João Reis)
        [#28858](#28858)
- **build**:
    - make full-icu the default for releases (Richard Lau)
        [#29887](#29887)
    - update minimum Xcode version for macOS (Michael Dawson)
        [#29622](#29622)
- **child_process**:
    - runtime deprecate \_channel (cjihrig)
        [#27949](#27949)
    - simplify spawn argument parsing (cjihrig)
        [#27854](#27854)
- **console**:
    - display timeEnd with suitable time unit (Xavier Stouder)
        [#29251](#29251)
- **deps**:
    - patch V8 to 7.8.279.14 (Myles Borins)
        [#29694](#29694)
    - patch V8 to 7.8.279.12 (Myles Borins)
        [#29694](#29694)
    - patch V8 to 7.8.279.10 (Myles Borins)
        [#29694](#29694)
    - update V8's postmortem script (cjihrig)
        [#29694](#29694)
    - V8: cherry-pick 716875d (Myles Borins)
        [#29694](#29694)
    - update V8 to 7.8.279.9 (Myles Borins)
        [#29694](#29694)
    - V8: cherry-pick b33af60 (Michaël Zasso)
        [#28016](#28016)
    - update V8 to 7.6.303.28 (Michaël Zasso)
        [#28016](#28016)
- **domain**:
    - error handler runs outside of its domain (Julien Gilli)
        [#26211](#26211)
- **fs**:
    - make FSWatcher.start private (Lucas Holmquist)
        [#29905](#29905)
    - add runtime deprecate for file stream open() (Robert Nagy)
    [#29061](#29061)
    - allow int64 offset in fs.write/writeSync/fd.write (Zach Bjornson)
    [#26572](#26572)
    - use IsSafeJsInt instead of IsNumber for ftruncate (Zach Bjornson)
    [#26572](#26572)
    - allow int64 offset in fs.read/readSync/fd.read (Zach Bjornson)
    [#26572](#26572)
    - close file descriptor of promisified truncate (João Reis)
    [#28858](#28858)
- **http**:
    - do not emit end after aborted (Robert Nagy)
        [#27984](#27984)
    - don't emit 'data' after 'error' (Robert Nagy)
        [#28711](#28711)
    - remove legacy parser (Anna Henningsen)
        [#29589](#29589)
    - throw if 'host' agent header is not a string value
        (Giorgos Ntemiris)
        [#29568](#29568)
    - replace superfluous connection property with getter/setter
        (Robert Nagy)
        [#29015](#29015)
    - fix test where aborted should not be emitted (Robert Nagy)
        [#20077](#20077)
    - remove default 'timeout' listener on upgrade (Luigi Pinca)
        [#26030](#26030)
- **http, http2**:
    - remove default server timeout (Ali Ijaz Sheikh)
        [#27558](#27558)
- **http2**:
    - remove security revert flags (Anna Henningsen)
        [#29141](#29141)
    - remove callback-based padding (Anna Henningsen)
        [#29144](#29144)
- **lib**:
    - rename validateInteger to validateSafeInteger (Zach Bjornson)
        [#26572](#26572)
    - correct error.errno to always be numeric (Joyee Cheung)
        [#28140](#28140)
    - no need to strip BOM or shebang for scripts (Refael Ackermann)
        [#27375](#27375)
    - rework logic of stripping BOM+Shebang from commonjs (Gus Caplan)
        [#27768](#27768)
- **module**:
    - runtime deprecate createRequireFromPath() (cjihrig)
        [#27951](#27951)
- **readline**:
    - error on falsy values for callback (Sam Roberts)
        [#28109](#28109)
- **repl**:
    - close file descriptor of history file (João Reis)
        [#28858](#28858)
- **src**:
    - bring 425 status code name into accordance with RFC 8470
        (Sergei Osipov)
        [#29880](#29880)
    - update NODE\_MODULE\_VERSION to 79 (Myles Borins)
        [#29694](#29694)
    - update NODE\_MODULE\_VERSION to 78 (Michaël Zasso)
        [#28918](#28918)
    - add error codes to errors thrown in C++ (Yaniv Friedensohn)
        [#27700](#27700)
    - use non-deprecated overload of V8::SetFlagsFromString
        (Michaël Zasso)
        [#28016](#28016)
    - update NODE\_MODULE\_VERSION to 77 (Michaël Zasso)
        [#28016](#28016)
    - update NODE\_MODULE\_VERSION to 74 (Refael Ackermann)
        [#27375](#27375)
    - make process.env.TZ setter clear tz cache (Ben Noordhuis)
        [#20026](#20026)
    - enable V8's WASM trap handlers (Gus Caplan)
        [#27246](#27246)
- **stream**:
    - throw unhandled error for readable with autoDestroy (Robert Nagy)
        [#29806](#29806)
    - always invoke callback before emitting error (Robert Nagy)
        [#29293](#29293)
    - invoke callback before emitting error always (Robert Nagy)
        [#29293](#29293)
    - do not flush destroyed writable (Robert Nagy)
        [#29028](#29028)
    - don't emit finish on error (Robert Nagy)
        [#28979](#28979)
    - disallow stream methods on finished stream (Robert Nagy)
        [#28687](#28687)
    - do not emit after 'error' (Robert Nagy)
        [#28708](#28708)
    - fix destroy() behavior (Robert Nagy)
        [#29058](#29058)
    - simplify `.pipe()` and `.unpipe()` in Readable (Weijia Wang)
        [#28583](#28583)
- **tools**:
    - patch V8 to run on older XCode versions (Ujjwal Sharma)
        [#29694](#29694)
    - update V8 gypfiles (Michaël Zasso)
        [#29694](#29694)
    - support full-icu by default (Steven R. Loomis)
        [#29522](#29522)
- **util**: validate formatWithOptions inspectOptions
    (Ruben Bridgewater)
    [#29824](#29824)

PR-URL: #29504
BethGriggs added a commit that referenced this pull request Oct 22, 2019
Notable changes:

* assert:
  * If the validation function passed to `assert.throws()` or
    `assert.rejects()` returns a value other than `true`, an assertion
    error will be thrown instead of the original error to highlight the
    progamming mistake (Ruben Bridgewater).
    #28263
  * If a constructor function is passed to validate the instance of
    errors thrown in `assert.throws()` or `assert.reject()`, an
    assertion error will be thrown instead of the original error
    (Ruben Bridgewater).
    #28263
* build:
  * Node.js releases are now built with default full-icu support. This
    means that all locales supported by ICU are now included and
    Intl-related APIs may return different values than before
    (Richard Lau).
    #29887
  * The minimum Xcode version supported for macOS was increased to 10.
    It is still possible to build Node.js with Xcode 8 but this may no
    longer be the case in a future v13.x release (Michael Dawson).
    #29622
* child_process:
  * `ChildProcess._channel` (DEP0129) is now a Runtime deprecation
    (cjihrig).
    #27949
* console:
  * The output `console.timeEnd()` and `console.timeLog()` will now
    automatically select a suitable time unit instead of always using
    milliseconds (Xavier Stouder).
    #29251
* deps:
  * The V8 engine was updated to version 7.8. This includes performance
    improvements to object destructuring, memory usage and WebAssembly
    startup time (Myles Borins).
    #29694)
* domain:
  * The domain's error handler is now executed with the active domain
    set to the domain's parent to prevent inner recursion
    (Julien Gilli).
    #26211
* fs:
  * The undocumented method `FSWatcher.prototype.start()` was removed
    (Lucas Holmquist).
    #29905
  * Calling the `open()` method on a `ReadStream` or `WriteStream` now
    emits a runtime deprecation warning. The methods are supposed to be
    internal and should not be called by user code (Robert Nagy).
    #29061
  * `fs.read/write`, `fs.readSync/writeSync` and `fd.read/write` now
    accept any safe integer as their `offset` parameter. The value of
    `offset` is also no longer coerced, so a valid type must be passed
    to the functions (Zach Bjornson).
    #26572
* http:
  * Aborted requests no longer emit the `end` or `error` events after
    `aborted` (Robert Nagy).
    #27984
    #20077
  * Data will no longer be emitted after a socket error (Robert Nagy).
    #28711
  * The legacy HTTP parser (previously available under the
    `--http-parser=legacy` flag) was removed (Anna Henningsen).
    #29589
  * The `host` option for HTTP requests is now validated to be a string
    value (Giorgos Ntemiris).
    #29568
  * The `request.connection` and `response.connection` properties are now
    runtime deprecated. The equivalent `request.socket` and `response.socket`
    should be used instead (Robert Nagy).
    #29015
* http, http2:
  * The default server timeout was removed (Ali Ijaz Sheikh).
    #27558
  * Brought 425 status code name into accordance with RFC 8470. The name
    changed from "Unordered Collection" to "Too Early" (Sergei Osipov).
    #29880
* lib:
  * The `error.errno` property will now always be a number. To get the
    string value, use `error.code` instead (Joyee Cheung).
    #28140
* module:
  * `module.createRequireFromPath()` is deprecated. Use
    `module.createRequire()` instead (cjihrig).
    #27951
* src:
  * Changing the value of `process.env.TZ` will now clear the tz cache.
    This affects the default time zone used by methods such as
    `Date.prototype.toString` (Ben Noordhuis).
    #20026
* stream:
  * The timing and behavior of streams was consolidated for a number of
    edge cases. Please look at the individual commits below for more
    information.

PR-URL: #29504
BethGriggs added a commit that referenced this pull request Oct 22, 2019
Notable changes:

* assert:
  * If the validation function passed to `assert.throws()` or
    `assert.rejects()` returns a value other than `true`, an assertion
    error will be thrown instead of the original error to highlight the
    programming mistake (Ruben Bridgewater).
    #28263
  * If a constructor function is passed to validate the instance of
    errors thrown in `assert.throws()` or `assert.reject()`, an
    assertion error will be thrown instead of the original error
    (Ruben Bridgewater).
    #28263
* build:
  * Node.js releases are now built with default full-icu support. This
    means that all locales supported by ICU are now included and
    Intl-related APIs may return different values than before
    (Richard Lau).
    #29887
  * The minimum Xcode version supported for macOS was increased to 10.
    It is still possible to build Node.js with Xcode 8 but this may no
    longer be the case in a future v13.x release (Michael Dawson).
    #29622
* child_process:
  * `ChildProcess._channel` (DEP0129) is now a Runtime deprecation
    (cjihrig).
    #27949
* console:
  * The output `console.timeEnd()` and `console.timeLog()` will now
    automatically select a suitable time unit instead of always using
    milliseconds (Xavier Stouder).
    #29251
* deps:
  * The V8 engine was updated to version 7.8. This includes performance
    improvements to object destructuring, memory usage and WebAssembly
    startup time (Myles Borins).
    #29694)
* domain:
  * The domain's error handler is now executed with the active domain
    set to the domain's parent to prevent inner recursion
    (Julien Gilli).
    #26211
* fs:
  * The undocumented method `FSWatcher.prototype.start()` was removed
    (Lucas Holmquist).
    #29905
  * Calling the `open()` method on a `ReadStream` or `WriteStream` now
    emits a runtime deprecation warning. The methods are supposed to be
    internal and should not be called by user code (Robert Nagy).
    #29061
  * `fs.read/write`, `fs.readSync/writeSync` and `fd.read/write` now
    accept any safe integer as their `offset` parameter. The value of
    `offset` is also no longer coerced, so a valid type must be passed
    to the functions (Zach Bjornson).
    #26572
* http:
  * Aborted requests no longer emit the `end` or `error` events after
    `aborted` (Robert Nagy).
    #27984
    #20077
  * Data will no longer be emitted after a socket error (Robert Nagy).
    #28711
  * The legacy HTTP parser (previously available under the
    `--http-parser=legacy` flag) was removed (Anna Henningsen).
    #29589
  * The `host` option for HTTP requests is now validated to be a string
    value (Giorgos Ntemiris).
    #29568
  * The `request.connection` and `response.connection` properties are now
    runtime deprecated. The equivalent `request.socket` and `response.socket`
    should be used instead (Robert Nagy).
    #29015
* http, http2:
  * The default server timeout was removed (Ali Ijaz Sheikh).
    #27558
  * Brought 425 status code name into accordance with RFC 8470. The name
    changed from "Unordered Collection" to "Too Early" (Sergei Osipov).
    #29880
* lib:
  * The `error.errno` property will now always be a number. To get the
    string value, use `error.code` instead (Joyee Cheung).
    #28140
* module:
  * `module.createRequireFromPath()` is deprecated. Use
    `module.createRequire()` instead (cjihrig).
    #27951
* src:
  * Changing the value of `process.env.TZ` will now clear the tz cache.
    This affects the default time zone used by methods such as
    `Date.prototype.toString` (Ben Noordhuis).
    #20026
* stream:
  * The timing and behavior of streams was consolidated for a number of
    edge cases. Please look at the individual commits below for more
    information.

PR-URL: #29504
BethGriggs added a commit that referenced this pull request Oct 22, 2019
Notable changes:

* assert:
  * If the validation function passed to `assert.throws()` or
    `assert.rejects()` returns a value other than `true`, an assertion
    error will be thrown instead of the original error to highlight the
    programming mistake (Ruben Bridgewater).
    #28263
  * If a constructor function is passed to validate the instance of
    errors thrown in `assert.throws()` or `assert.reject()`, an
    assertion error will be thrown instead of the original error
    (Ruben Bridgewater).
    #28263
* build:
  * Node.js releases are now built with default full-icu support. This
    means that all locales supported by ICU are now included and
    Intl-related APIs may return different values than before
    (Richard Lau).
    #29887
  * The minimum Xcode version supported for macOS was increased to 10.
    It is still possible to build Node.js with Xcode 8 but this may no
    longer be the case in a future v13.x release (Michael Dawson).
    #29622
* child_process:
  * `ChildProcess._channel` (DEP0129) is now a Runtime deprecation
    (cjihrig).
    #27949
* console:
  * The output `console.timeEnd()` and `console.timeLog()` will now
    automatically select a suitable time unit instead of always using
    milliseconds (Xavier Stouder).
    #29251
* deps:
  * The V8 engine was updated to version 7.8. This includes performance
    improvements to object destructuring, memory usage and WebAssembly
    startup time (Myles Borins).
    #29694)
* domain:
  * The domain's error handler is now executed with the active domain
    set to the domain's parent to prevent inner recursion
    (Julien Gilli).
    #26211
* fs:
  * The undocumented method `FSWatcher.prototype.start()` was removed
    (Lucas Holmquist).
    #29905
  * Calling the `open()` method on a `ReadStream` or `WriteStream` now
    emits a runtime deprecation warning. The methods are supposed to be
    internal and should not be called by user code (Robert Nagy).
    #29061
  * `fs.read/write`, `fs.readSync/writeSync` and `fd.read/write` now
    accept any safe integer as their `offset` parameter. The value of
    `offset` is also no longer coerced, so a valid type must be passed
    to the functions (Zach Bjornson).
    #26572
* http:
  * Aborted requests no longer emit the `end` or `error` events after
    `aborted` (Robert Nagy).
    #27984
    #20077
  * Data will no longer be emitted after a socket error (Robert Nagy).
    #28711
  * The legacy HTTP parser (previously available under the
    `--http-parser=legacy` flag) was removed (Anna Henningsen).
    #29589
  * The `host` option for HTTP requests is now validated to be a string
    value (Giorgos Ntemiris).
    #29568
  * The `request.connection` and `response.connection` properties are now
    runtime deprecated. The equivalent `request.socket` and `response.socket`
    should be used instead (Robert Nagy).
    #29015
* http, http2:
  * The default server timeout was removed (Ali Ijaz Sheikh).
    #27558
  * Brought 425 status code name into accordance with RFC 8470. The name
    changed from "Unordered Collection" to "Too Early" (Sergei Osipov).
    #29880
* lib:
  * The `error.errno` property will now always be a number. To get the
    string value, use `error.code` instead (Joyee Cheung).
    #28140
* module:
  * `module.createRequireFromPath()` is deprecated. Use
    `module.createRequire()` instead (cjihrig).
    #27951
* src:
  * Changing the value of `process.env.TZ` will now clear the tz cache.
    This affects the default time zone used by methods such as
    `Date.prototype.toString` (Ben Noordhuis).
    #20026
* stream:
  * The timing and behavior of streams was consolidated for a number of
    edge cases. Please look at the individual commits below for more
    information.

PR-URL: #29504
BethGriggs added a commit that referenced this pull request Oct 22, 2019
Notable changes:

* assert:
  * If the validation function passed to `assert.throws()` or
    `assert.rejects()` returns a value other than `true`, an assertion
    error will be thrown instead of the original error to highlight the
    programming mistake (Ruben Bridgewater).
    #28263
  * If a constructor function is passed to validate the instance of
    errors thrown in `assert.throws()` or `assert.reject()`, an
    assertion error will be thrown instead of the original error
    (Ruben Bridgewater).
    #28263
* build:
  * Node.js releases are now built with default full-icu support. This
    means that all locales supported by ICU are now included and
    Intl-related APIs may return different values than before
    (Richard Lau).
    #29887
  * The minimum Xcode version supported for macOS was increased to 10.
    It is still possible to build Node.js with Xcode 8 but this may no
    longer be the case in a future v13.x release (Michael Dawson).
    #29622
* child_process:
  * `ChildProcess._channel` (DEP0129) is now a Runtime deprecation
    (cjihrig).
    #27949
* console:
  * The output `console.timeEnd()` and `console.timeLog()` will now
    automatically select a suitable time unit instead of always using
    milliseconds (Xavier Stouder).
    #29251
* deps:
  * The V8 engine was updated to version 7.8. This includes performance
    improvements to object destructuring, memory usage and WebAssembly
    startup time (Myles Borins).
    #29694)
* domain:
  * The domain's error handler is now executed with the active domain
    set to the domain's parent to prevent inner recursion
    (Julien Gilli).
    #26211
* fs:
  * The undocumented method `FSWatcher.prototype.start()` was removed
    (Lucas Holmquist).
    #29905
  * Calling the `open()` method on a `ReadStream` or `WriteStream` now
    emits a runtime deprecation warning. The methods are supposed to be
    internal and should not be called by user code (Robert Nagy).
    #29061
  * `fs.read/write`, `fs.readSync/writeSync` and `fd.read/write` now
    accept any safe integer as their `offset` parameter. The value of
    `offset` is also no longer coerced, so a valid type must be passed
    to the functions (Zach Bjornson).
    #26572
* http:
  * Aborted requests no longer emit the `end` or `error` events after
    `aborted` (Robert Nagy).
    #27984
    #20077
  * Data will no longer be emitted after a socket error (Robert Nagy).
    #28711
  * The legacy HTTP parser (previously available under the
    `--http-parser=legacy` flag) was removed (Anna Henningsen).
    #29589
  * The `host` option for HTTP requests is now validated to be a string
    value (Giorgos Ntemiris).
    #29568
  * The `request.connection` and `response.connection` properties are now
    runtime deprecated. The equivalent `request.socket` and `response.socket`
    should be used instead (Robert Nagy).
    #29015
* http, http2:
  * The default server timeout was removed (Ali Ijaz Sheikh).
    #27558
  * Brought 425 status code name into accordance with RFC 8470. The name
    changed from "Unordered Collection" to "Too Early" (Sergei Osipov).
    #29880
* lib:
  * The `error.errno` property will now always be a number. To get the
    string value, use `error.code` instead (Joyee Cheung).
    #28140
* module:
  * `module.createRequireFromPath()` is deprecated. Use
    `module.createRequire()` instead (cjihrig).
    #27951
* src:
  * Changing the value of `process.env.TZ` will now clear the tz cache.
    This affects the default time zone used by methods such as
    `Date.prototype.toString` (Ben Noordhuis).
    #20026
* stream:
  * The timing and behavior of streams was consolidated for a number of
    edge cases. Please look at the individual commits below for more
    information.

PR-URL: #29504
@voxsoftware

This comment has been minimized.

Copy link

voxsoftware commented Nov 7, 2019

What about problems on new parser HPE_INVALID_HEADER_TOKEN when the servers sends invalid header? Only the old parser can work with that sites, so what can be used in node 13.x?

@Legogris

This comment has been minimized.

Copy link

Legogris commented Nov 15, 2019

I only noticed this now and would like to chime in that there are still major services with APIs out there where HTTP requests will break when not using --http-parser=legacy.

There are absolutely production systems out there that rely on being able to use --http-parser=legacy. As things stand, we have production systems that are currently stuck on node v12 since upgrading will break existing behavior.

I know that this has already been merged and approved, but I'd like to raise the possibility of considering keeping the legacy parser around (or extending the new implementation to support invalid headers).

To me this is a bit along the lines of releasing an update to a web browser expecting all HTML to be following the XHTML spec to the T. Yes, it's the fault of the server not following defined APIs, but users still need to be able to connect to them.

@sam-github

This comment has been minimized.

Copy link
Member

sam-github commented Nov 15, 2019

@Legogris Are there open issues tracking the specific problems blocking your update to the llhttp parser?

Reenabling the legacy parser might not solve your problem for long. If we reenable it, we'd have to maintain it, and accepting invalid HTTP has been a repeating source of security reports (which is one reason we don't want the legacy http parser around anymore, it has a maintenance cost).

If there is a case to be made that headers should be rejected, it is true for both parsers, and if there is a case to be made that the parsers are too strict and should accept some malformed headers, that would apply to the llhttp parser as well.

@Legogris

This comment has been minimized.

Copy link

Legogris commented Nov 16, 2019

@Legogris Are there open issues tracking the specific problems blocking your update to the llhttp parser?

One example is mentioned here of how requests to services behind Incapsula will break because of consciously sending malformed cookies: #27711 (comment)

I do think this is not good behavior on Incapsula's part, but a significant amount of services still use them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.