Fix connection upgrades when backend server is using h2c scheme by stffabi · Pull Request #12967 · traefik/traefik

stffabi · 2026-04-13T06:48:06Z

What does this PR do?

This PR fixes a long standing bug #7465 which prevents the usage of h2c backend scheme and websockets. The fix consist of correctly mapping the h2c scheme to http for "Connection-Upgrades" that will be handled by the http only http.Transport.

More information can be found in my comment #7465 (comment)

Motivation

We are unable to deploy h2c in the backend where those services also provide websockets.

More

Added/updated tests
Added/updated documentation

Additional Notes

fixes #7465

nmengin · 2026-04-13T12:44:11Z

Hey @stffabi,

Thanks for the contribution!
We've marked this for "need-triage" to check if there are any deeper impacts on Traefik before we move forward.
We'll keep you posted once we're done reviewing.

kevinpollet · 2026-04-16T12:28:29Z

Hey @stffabi,

We've set the status to "design-review" to allow us to check the PR and ensure there is no deep impact on Traefik before moving forward.

We'll keep you updated once the analysis is done.

stffabi · 2026-04-17T06:35:55Z

@kevinpollet Thanks for the information.

stffabi · 2026-05-15T18:06:04Z

@kevinpollet any news on this one? It is now about a month since the PR has been opened. Would be great if this can be merged or at least reviewed soon, as this is going to fix a long standing issue in Traefik for more than 5 years.

rtribotte

Thanks!

kevinpollet · 2026-06-16T07:11:55Z

Thanks 👍

Fixes traefik#7465

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [traefik](https://github.com/containous/traefik) | patch | `v3.7.5` → `v3.7.6` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/12) for more information. --- ### Release Notes <details> <summary>containous/traefik (traefik)</summary> ### [`v3.7.6`](https://github.com/containous/traefik/blob/HEAD/CHANGELOG.md#v376-2026-06-30) [Compare Source](traefik/traefik@v3.7.6...v3.7.6) [All Commits](traefik/traefik@v3.7.5...v3.7.6) **Bug fixes:** - **\[acme, logs]** Bump github.com/go-acme/lego/v5 ([#13154](traefik/traefik#13154) [@ldez](https://github.com/ldez)) - **\[acme]** Bump github.com/go-acme/lego/v5 ([#13359](traefik/traefik#13359) [@juliens](https://github.com/juliens)) - **\[k8s, k8s/ingress-nginx]** Fix ingress-nginx ssl passthrough status updates ([#13212](traefik/traefik#13212) [@nickmnt](https://github.com/nickmnt)) - **\[k8s/gatewayapi]** Add missing Gateway API features in conformance tests ([#13356](traefik/traefik#13356) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[k8s/gatewayapi]** Avoid collisions for Gateway API services names ([#13367](traefik/traefik#13367) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/gatewayapi]** Ignore other gateways parentRefs and update route parent statuses only for managed gateways ([#13397](traefik/traefik#13397) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/ingress-nginx]** Configure retry according to buffering configuration ([#13039](traefik/traefik#13039) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/ingress-nginx]** Fix force-ssl-redirect routing 418 when TLS is terminated upstream ([#13386](traefik/traefik#13386) [@carloslima](https://github.com/carloslima)) - **\[k8s]** Detect EndpointSlice condition changes ([#13405](traefik/traefik#13405) [@kevinpollet](https://github.com/kevinpollet)) - **\[k8s]** Index Kubernetes EndpointSlice by service name ([#13395](traefik/traefik#13395) [@kevinpollet](https://github.com/kevinpollet)) - **\[k8s]** Sort endpointslices to keep backend IPs consistent across rebuilds ([#13406](traefik/traefik#13406) [@kevinpollet](https://github.com/kevinpollet)) - **\[kv]** Bump kvtools/redis to v1.2.1 ([#13403](traefik/traefik#13403) [@ldez](https://github.com/ldez)) - **\[middleware, authentication]** Fix x-forwarded-port in forward-auth ([#13344](traefik/traefik#13344) [@juliens](https://github.com/juliens)) - **\[middleware, k8s/gatewayapi]** Fix Gateway API redirect missing statuses ([#13360](traefik/traefik#13360) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[middleware, k8s/gatewayapi]** Fix Host header not being modified by RequestHeaderModifier ([#12805](traefik/traefik#12805) [@mihuross](https://github.com/mihuross)) - **\[middleware, k8s/gatewayapi]** Fix request scheme derivation when Gateway API RequestRedirect omits scheme ([#13347](traefik/traefik#13347) [@gndz07](https://github.com/gndz07)) - **\[middleware]** Fix CORS Max-Age set to 0 by default ([#13371](traefik/traefik#13371) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[middleware]** Fix CORS wildcard when allow-credentials is true ([#13368](traefik/traefik#13368) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[server]** Add an option to remove request headers with underscores ([#13262](traefik/traefik#13262) [@youkoulayley](https://github.com/youkoulayley)) - **\[server]** Configurable max request header size ([#13353](traefik/traefik#13353) [@juliens](https://github.com/juliens)) - **\[tls]** Fix nondeterministic TLS certificate selection on shared SAN ([#13348](traefik/traefik#13348) [@rtribotte](https://github.com/rtribotte)) - **\[webui]** Bump axios to v1.18.0 ([#13380](traefik/traefik#13380) [@gndz07](https://github.com/gndz07)) - **\[websocket]** Fix connection upgrades when backend server is using h2c scheme ([#12967](traefik/traefik#12967) [@stffabi](https://github.com/stffabi)) **Documentation:** - **\[k8s/crd]** Fix broken CRD reference links in IngressRoute page ([#13375](traefik/traefik#13375) [@s3onghyun](https://github.com/s3onghyun)) - **\[k8s/gatewayapi]** Remove experimental note for Gateway API/TLSRoute documentation ([#13392](traefik/traefik#13392) [@jnoordsij](https://github.com/jnoordsij)) - **\[k8s/ingress-nginx]** Add Kubernetes Ingress NGINX to the providers list ([#13372](traefik/traefik#13372) [@nmengin](https://github.com/nmengin)) - **\[k8s]** Align Helm chart documented values with chart v41 ([#13366](traefik/traefik#13366) [@mloiseleur](https://github.com/mloiseleur)) - **\[middleware, authentication, k8s/ingress-nginx]** Clarify intentional auth-response-headers gating and absence of stripping incoming X-Forwarded-\* headers ([#13342](traefik/traefik#13342) [@rtribotte](https://github.com/rtribotte)) - **\[middleware]** Clarify entryPoint middleware reference format ([#13364](traefik/traefik#13364) [@mloiseleur](https://github.com/mloiseleur)) - **\[security]** Add HTTP/2 header memory exhaustion security documentation ([#13381](traefik/traefik#13381) [@emilevauge](https://github.com/emilevauge)) - Adds documentations on maxHeaderBytes ([#13363](traefik/traefik#13363) [@juliens](https://github.com/juliens)) - Fix inaccuracies in reference documentation ([#13304](traefik/traefik#13304) [@sheddy-traefik](https://github.com/sheddy-traefik)) ### [`v3.7.6`](https://github.com/containous/traefik/blob/HEAD/CHANGELOG.md#v376-2026-06-30) [Compare Source](traefik/traefik@v3.7.5...v3.7.6) [All Commits](traefik/traefik@v3.7.5...v3.7.6) **Bug fixes:** - **\[acme, logs]** Bump github.com/go-acme/lego/v5 ([#13154](traefik/traefik#13154) [@ldez](https://github.com/ldez)) - **\[acme]** Bump github.com/go-acme/lego/v5 ([#13359](traefik/traefik#13359) [@juliens](https://github.com/juliens)) - **\[k8s, k8s/ingress-nginx]** Fix ingress-nginx ssl passthrough status updates ([#13212](traefik/traefik#13212) [@nickmnt](https://github.com/nickmnt)) - **\[k8s/gatewayapi]** Add missing Gateway API features in conformance tests ([#13356](traefik/traefik#13356) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[k8s/gatewayapi]** Avoid collisions for Gateway API services names ([#13367](traefik/traefik#13367) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/gatewayapi]** Ignore other gateways parentRefs and update route parent statuses only for managed gateways ([#13397](traefik/traefik#13397) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/ingress-nginx]** Configure retry according to buffering configuration ([#13039](traefik/traefik#13039) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/ingress-nginx]** Fix force-ssl-redirect routing 418 when TLS is terminated upstream ([#13386](traefik/traefik#13386) [@carloslima](https://github.com/carloslima)) - **\[k8s]** Detect EndpointSlice condition changes ([#13405](traefik/traefik#13405) [@kevinpollet](https://github.com/kevinpollet)) - **\[k8s]** Index Kubernetes EndpointSlice by service name ([#13395](traefik/traefik#13395) [@kevinpollet](https://github.com/kevinpollet)) - **\[k8s]** Sort endpointslices to keep backend IPs consistent across rebuilds ([#13406](traefik/traefik#13406) [@kevinpollet](https://github.com/kevinpollet)) - **\[kv]** Bump kvtools/redis to v1.2.1 ([#13403](traefik/traefik#13403) [@ldez](https://github.com/ldez)) - **\[middleware, authentication]** Fix x-forwarded-port in forward-auth ([#13344](traefik/traefik#13344) [@juliens](https://github.com/juliens)) - **\[middleware, k8s/gatewayapi]** Fix Gateway API redirect missing statuses ([#13360](traefik/traefik#13360) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[middleware, k8s/gatewayapi]** Fix Host header not being modified by RequestHeaderModifier ([#12805](traefik/traefik#12805) [@mihuross](https://github.com/mihuross)) - **\[middleware, k8s/gatewayapi]** Fix request scheme derivation when Gateway API RequestRedirect omits scheme ([#13347](traefik/traefik#13347) [@gndz07](https://github.com/gndz07)) - **\[middleware]** Fix CORS Max-Age set to 0 by default ([#13371](traefik/traefik#13371) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[middleware]** Fix CORS wildcard when allow-credentials is true ([#13368](traefik/traefik#13368) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[server]** Add an option to remove request headers with underscores ([#13262](traefik/traefik#13262) [@youkoulayley](https://github.com/youkoulayley)) - **\[server]** Configurable max request header size ([#13353](traefik/traefik#13353) [@juliens](https://github.com/juliens)) - **\[tls]** Fix nondeterministic TLS certificate selection on shared SAN ([#13348](traefik/traefik#13348) [@rtribotte](https://github.com/rtribotte)) - **\[webui]** Bump axios to v1.18.0 ([#13380](traefik/traefik#13380) [@gndz07](https://github.com/gndz07)) - **\[websocket]** Fix connection upgrades when backend server is using h2c scheme ([#12967](traefik/traefik#12967) [@stffabi](https://github.com/stffabi)) **Documentation:** - **\[k8s/crd]** Fix broken CRD reference links in IngressRoute page ([#13375](traefik/traefik#13375) [@s3onghyun](https://github.com/s3onghyun)) - **\[k8s/gatewayapi]** Remove experimental note for Gateway API/TLSRoute documentation ([#13392](traefik/traefik#13392) [@jnoordsij](https://github.com/jnoordsij)) - **\[k8s/ingress-nginx]** Add Kubernetes Ingress NGINX to the providers list ([#13372](traefik/traefik#13372) [@nmengin](https://github.com/nmengin)) - **\[k8s]** Align Helm chart documented values with chart v41 ([#13366](traefik/traefik#13366) [@mloiseleur](https://github.com/mloiseleur)) - **\[middleware, authentication, k8s/ingress-nginx]** Clarify intentional auth-response-headers gating and absence of stripping incoming X-Forwarded-\* headers ([#13342](traefik/traefik#13342) [@rtribotte](https://github.com/rtribotte)) - **\[middleware]** Clarify entryPoint middleware reference format ([#13364](traefik/traefik#13364) [@mloiseleur](https://github.com/mloiseleur)) - **\[security]** Add HTTP/2 header memory exhaustion security documentation ([#13381](traefik/traefik#13381) [@emilevauge](https://github.com/emilevauge)) - Adds documentations on maxHeaderBytes ([#13363](traefik/traefik#13363) [@juliens](https://github.com/juliens)) - Fix inaccuracies in reference documentation ([#13304](traefik/traefik#13304) [@sheddy-traefik](https://github.com/sheddy-traefik)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.jfreudenberger.de/JuliusFreudenberger/nix-config/pulls/16 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

traefiker added size/S status/0-needs-triage labels Apr 13, 2026

traefiker added this to the 3.6 milestone Apr 13, 2026

stffabi mentioned this pull request Apr 13, 2026

websocket with http/2 cleartext lead to http 500 #7465

Closed

nmengin added the area/websocket label Apr 13, 2026

kevinpollet added status/1-needs-design-review kind/bug/fix a bug fix and removed status/0-needs-triage labels Apr 16, 2026

nmengin requested review from juliens and rtribotte June 4, 2026 13:12

juliens force-pushed the feature/fix-h2c-connection-upgrades branch from 422e614 to 348cb37 Compare June 15, 2026 14:07

rtribotte changed the title ~~Fix connection upgrades (websocket) when backend server is using h2c~~ Fix connection upgrades when backend server is using h2c scheme Jun 15, 2026

rtribotte added status/2-needs-review and removed status/1-needs-design-review labels Jun 15, 2026

juliens force-pushed the feature/fix-h2c-connection-upgrades branch from 348cb37 to 4b13c35 Compare June 15, 2026 14:42

rtribotte approved these changes Jun 15, 2026

View reviewed changes

kevinpollet approved these changes Jun 16, 2026

View reviewed changes

kevinpollet added status/3-needs-merge and removed status/2-needs-review labels Jun 16, 2026

traefiker added the status/4-merge-in-progress label Jun 16, 2026

stffabi and others added 2 commits June 16, 2026 07:18

Fix connection upgrades (websocket) when backend server is using h2c

24e09cb

Fixes traefik#7465

refacto

848e3a0

traefiker force-pushed the feature/fix-h2c-connection-upgrades branch from 4b13c35 to 848e3a0 Compare June 16, 2026 07:18

traefiker removed the status/4-merge-in-progress label Jun 16, 2026

traefiker merged commit 9f7bd55 into traefik:v3.6 Jun 16, 2026
51 checks passed

traefiker removed the status/3-needs-merge label Jun 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Fix connection upgrades when backend server is using h2c scheme#12967

Fix connection upgrades when backend server is using h2c scheme#12967
traefiker merged 2 commits into
traefik:v3.6from
stffabi:feature/fix-h2c-connection-upgrades

stffabi commented Apr 13, 2026 •

edited

Loading

Uh oh!

nmengin commented Apr 13, 2026

Uh oh!

kevinpollet commented Apr 16, 2026

Uh oh!

stffabi commented Apr 17, 2026

Uh oh!

stffabi commented May 15, 2026 •

edited

Loading

Uh oh!

rtribotte left a comment

Uh oh!

kevinpollet commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Uh oh!

Conversation

stffabi commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

More

Additional Notes

Uh oh!

nmengin commented Apr 13, 2026

Uh oh!

kevinpollet commented Apr 16, 2026

Uh oh!

stffabi commented Apr 17, 2026

Uh oh!

stffabi commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rtribotte left a comment

Choose a reason for hiding this comment

Uh oh!

kevinpollet commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

stffabi commented Apr 13, 2026 •

edited

Loading

stffabi commented May 15, 2026 •

edited

Loading