Skip to content

[GW] Respond 502 Bad Gateway when receiving HTTP_1_1_REQUIRED #17423

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Oct 11, 2024
Merged

[GW] Respond 502 Bad Gateway when receiving HTTP_1_1_REQUIRED #17423

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ff444a6
[ZT] Gateway will respond 502 Bad Gateway when receiving HTTP_1_1_REQ…
kyouheicf Oct 9, 2024
8dffc89
Apply PCX style guide
maxvp Oct 10, 2024
a74457b
Fix with the intended context
kyouheicf Oct 11, 2024
2ba77d7
Fix grammar
maxvp Oct 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/content/docs/cloudflare-one/faq/troubleshooting.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,3 +174,9 @@ To enable software rasterization:
By default, the WARP client blocks outgoing SMTP traffic on port `25` to prevent users from abusing our service to send spam. Modern email service providers use port `587` or `465` to encrypt emails over a TLS/SSL connection. For more information, refer to [What SMTP port should be used?](https://www.cloudflare.com/learning/email-security/smtp-port-25-587/).

If you need to unblock port `25`, contact your account team.

## I see `502 Bad Gateway` when browsing to a website.

This issue can occur when communicating with an origin that partially supports HTTP/2. In these scenarios, the connection from Gateway to the website starts using HTTP/2 but requests a downgrade to HTTP/1.1 for some requests. For example, servers such as [Microsoft Internet Information Services (IIS)](https://learn.microsoft.com/iis/get-started/whats-new-in-iis-10/http2-on-iis#when-is-http2-not-supported) do not support authentication over HTTP/2. When errors occur, the website may send back a `RST_STREAM` frame with the error code `HTTP_1_1_REQUIRED`, which indicates that the browser should retry the request over HTTP/1.1. Gateway translates any received upstream `RST_STREAM` frames to a pseudo socket close, so this appears as a `502 Bad Gateway` exception page. The browser will not indicate why failed.

Gateway does not support this downgrade mechanism. Instead, when receiving the `HTTP_1_1_REQUIRED` error code, Gateway will reissue requests over HTTP/1.1. To make the connection from Gateway to the website successfully, you will need to disable HTTP/2 at the origin.
Loading