hackney Files

Security

• A server could make hackney buffer an unlimited amount of data despite max_body_size, by sending an HTTP/1.1 chunked body made of one very large chunk: the limit was only checked once a whole chunk had arrived. Chunk data is now handed on as it arrives, so the limit holds and streamed reads no longer wait for the end of a chunk. A chunk-size line longer than 4096 bytes or a size of more than 16 hex digits is now refused.

Changed

• An HTTP/2 or HTTP/3 request made when the connection is at the server's limit on concurrent streams now waits for a free stream instead of failing at once. Many servers allow 100 or 128 at a time, so a burst of requests used to fail where HTTP/1.1 would have queued them. A request waits up to checkout_timeout, then fails with checkout_timeout. Based on work by Lennart Schoch (#972).
• A request the server refused without processing it, because of a GOAWAY, an HTTP/2 refused stream or an HTTP/3 rejected request, is now sent once more on a fresh connection, whatever its method. It used to fail, and most callers did not know that error was safe to retry. A body given as a function is not sent twice. Based on work by Lennart Schoch (#971).
• quic 2.6.1, h2 0.15.0 and webtransport 0.5.3. These bring fixes for an HTTP/3 header block that could keep a CPU busy for minutes, and for two HTTP/2 denial-of-service attacks (MadeYouReset and SETTINGS flood), plus many protocol conformance and reliability fixes.
• WebTransport now speaks draft-17 over HTTP/3 and draft-16 over HTTP/2. Servers on older drafts may no longer connect; a draft07 compat mode is available for draft-07 servers. WebTransport over HTTP/2 now needs TLS 1.3.
• When an HTTP/3 server closes the connection with an error code, the error you get now carries that code and phrase instead of reporting a normal close.

Added

• WebTransport subprotocol negotiation with the protocols and require_protocol options of wt_connect. The server's choice is in wt_session_info/1.
• In active mode, WebTransport sends {stream_credit, bidi | uni} once the server allows more streams after wt_open_stream/2 hit its limit.

Fixed

• An HTTP/3 request whose stream the server reset after sending headers waited until its timeout. It now fails at once with the reset reason.
• A request body given as a function crashed the connection on HTTP/2 and HTTP/3; it worked only on HTTP/1.1. It is now sent as the function yields it, on all three. If the function fails part way, you get its error and the half-sent request is cancelled (#1001).
• wt_close/2 with a reason longer than 1024 bytes returned ok but never closed the session. It now returns an error and the session stays open. The same now applies to an error code over 32 bits or a reason that is not valid UTF-8, which the drafts forbid.
• Reading a chunked HTTP/1.1 body no longer slows down with large chunks. The time grew with the square of the chunk size: a 16 MB body sent as one chunk took about 10 seconds on loopback, and now takes about 25 ms (#998, [#378]).
• Pooled requests to http+unix URLs now work. They always failed with nxdomain, so only unpooled requests could reach a unix socket. Socket paths with capital letters also work now (#997).
• hackney:cookies/1 no longer crashes when a response has an empty Set-Cookie header; that header is skipped and the other cookies are returned (#994).