From d798231b56bb4a6284999e3b868b503c4a7ee8d3 Mon Sep 17 00:00:00 2001 From: Roman Arutyunyan Date: Mon, 13 Jul 2026 22:16:34 +0400 Subject: [PATCH] Disable HTTP keepalive for HTTP CONNECT requests As per RFC 2817 Section 5.2: Like any other pipelined HTTP/1.1 request, data to be tunneled may be sent immediately after the blank line. The usual caveats also apply: data may be discarded if the eventual response is negative, and the connection may be reset with no response if more than one TCP segment is outstanding. --- src/http/ngx_http_core_module.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c index 4e1c67282..b4327c7bc 100644 --- a/src/http/ngx_http_core_module.c +++ b/src/http/ngx_http_core_module.c @@ -845,18 +845,21 @@ ngx_http_handler(ngx_http_request_t *r) r->connection->log->action = NULL; if (!r->internal) { - switch (r->headers_in.connection_type) { - case 0: - r->keepalive = (r->http_version > NGX_HTTP_VERSION_10); - break; - case NGX_HTTP_CONNECTION_CLOSE: - r->keepalive = 0; - break; + if (r->method != NGX_HTTP_CONNECT) { + switch (r->headers_in.connection_type) { + case 0: + r->keepalive = (r->http_version > NGX_HTTP_VERSION_10); + break; - case NGX_HTTP_CONNECTION_KEEP_ALIVE: - r->keepalive = 1; - break; + case NGX_HTTP_CONNECTION_CLOSE: + r->keepalive = 0; + break; + + case NGX_HTTP_CONNECTION_KEEP_ALIVE: + r->keepalive = 1; + break; + } } r->lingering_close = (r->headers_in.content_length_n > 0 -- 2.47.3