Repository navigation
fix: never send HTTP/3 requests past the proxy - #598
Draft
metalwarrior665 wants to merge 1 commit into
Draft
metalwarrior665 wants to merge 1 commit into
metalwarrior665 wants to merge 1 commit into
Conversation
reqwest sends HTTP/3 requests through its own QUIC connector, which ignores proxies. With `with_http3()` and a proxy, the first request to a host went through the proxy, and once the host advertised h3 (Alt-Svc or its HTTPS DNS record), later requests went out over QUIC from the machine's own IP address. HTTP/3 is now disabled (with a warning) when a proxy is set, either with `with_proxy` or in `HTTPS_PROXY` / `ALL_PROXY`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0148RYR4BTGyCYHENSRZjC3S
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
reqwest sends HTTP/3 requests through its own QUIC connector (
h3_client/connect.rs), which resolves the host and connects directly. Only the TCP connector knows about proxies, both in the crates.io release and in the patched revision impit uses. So withwith_http3()and a proxy:Alt-Svcor its HTTPS DNS record), impit caches it as HTTP/3-capable.Reproduced on
masterwithwith_http3(), a local logging CONNECT proxy, andhttps://www.google.com/:CONNECT www.google.com:443each.http3_prior_knowledgerequest never reached the proxy. strace shows the QUIC packets going straight from the process to142.251.153.119:443.H3Engine's HTTPS-record lookup also went straight to8.8.8.8/8.8.4.4.HTTP/3 is off by default, so only
http3: truetogether with a proxy is affected.With this change, HTTP/3 is disabled with a warning whenever a proxy is set: with
with_proxy, or inHTTPS_PROXY/ALL_PROXY, the variables reqwest reads for HTTPS. A request withhttp3_prior_knowledgethen fails withHttp3Disabled, whose message now mentions the proxy. I chose this over failing at build time so existinghttp3: trueplus proxy setups keep working, just over HTTP/2. It's easy to flip if you'd rather error.I also removed
.with_http3()from theImpitBuilderdoc example, which combined it with a proxy.The other half of the original #595, making HTTP/3 an opt-in Cargo feature, stays in #595.
Generated by Claude Code