]> git.kaiwu.me - nginx.git/commitdiff
HTTP/3: fix QPACK static table values to match RFC 9204
authorNexory <St4yl3r30@hotmail.de>
Fri, 23 Oct 2026 04:47:25 +0000 (06:47 +0200)
committerSergey Kandaurov <pluknet@nginx.com>
Wed, 28 Oct 2026 16:26:26 +0000 (20:26 +0400)
Five values of the static table lacked the space after a semicolon
compared to RFC 9204, Appendix A: indexes 52, 57, 58, 62 and 85.  A
field sent by a client as an indexed static entry was thus decoded
without the space, for example "text/html;charset=utf-8" instead of
"text/html; charset=utf-8" in the Content-Type header.  The encoder
is not affected, it does not use these indexes.

src/http/v3/ngx_http_v3_table.c

index c8255278f0a57b22164394df8f976f9bd7306be1..30df41e71f807379344a3e4e9ff20225eff03149 100644 (file)
@@ -88,7 +88,7 @@ static ngx_http_v3_field_t  ngx_http_v3_static_table[] = {
     { ngx_string("content-type"),          ngx_string("image/png") },
     { ngx_string("content-type"),          ngx_string("text/css") },
     { ngx_string("content-type"),
-          ngx_string("text/html;charset=utf-8") },
+          ngx_string("text/html; charset=utf-8") },
     { ngx_string("content-type"),          ngx_string("text/plain") },
     { ngx_string("content-type"),
           ngx_string("text/plain;charset=utf-8") },
@@ -96,14 +96,14 @@ static ngx_http_v3_field_t  ngx_http_v3_static_table[] = {
     { ngx_string("strict-transport-security"),
                                            ngx_string("max-age=31536000") },
     { ngx_string("strict-transport-security"),
-          ngx_string("max-age=31536000;includesubdomains") },
+          ngx_string("max-age=31536000; includesubdomains") },
     { ngx_string("strict-transport-security"),
-          ngx_string("max-age=31536000;includesubdomains;preload") },
+          ngx_string("max-age=31536000; includesubdomains; preload") },
     { ngx_string("vary"),                  ngx_string("accept-encoding") },
     { ngx_string("vary"),                  ngx_string("origin") },
     { ngx_string("x-content-type-options"),
                                            ngx_string("nosniff") },
-    { ngx_string("x-xss-protection"),      ngx_string("1;mode=block") },
+    { ngx_string("x-xss-protection"),      ngx_string("1; mode=block") },
     { ngx_string(":status"),               ngx_string("100") },
     { ngx_string(":status"),               ngx_string("204") },
     { ngx_string(":status"),               ngx_string("206") },
@@ -137,7 +137,7 @@ static ngx_http_v3_field_t  ngx_http_v3_static_table[] = {
     { ngx_string("alt-svc"),               ngx_string("clear") },
     { ngx_string("authorization"),         ngx_string("") },
     { ngx_string("content-security-policy"),
-          ngx_string("script-src 'none';object-src 'none';base-uri 'none'") },
+          ngx_string("script-src 'none'; object-src 'none'; base-uri 'none'") },
     { ngx_string("early-data"),            ngx_string("1") },
     { ngx_string("expect-ct"),             ngx_string("") },
     { ngx_string("forwarded"),             ngx_string("") },