From ca7e4f4473b413622bf609a9e0cfa2c833e8efe2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Eric=20Meadows-J=C3=B6nsson?= Date: Sat, 3 Oct 2026 00:00:32 +0200 Subject: [PATCH] Document that pushed origins aren't checked RFC 9113 8.4 only lets a server push responses for origins it's authoritative for. Mint doesn't check the pushed :scheme and :authority, so the server push docs now say to compare them with the connection's origin before using a pushed response and to cancel the promised request with cancel_request/2 if they don't match. The example of promised headers also lists :scheme and :authority, which promised requests always include. --- lib/mint/http2.ex | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/lib/mint/http2.ex b/lib/mint/http2.ex index 670a16a1..2a652c5b 100644 --- a/lib/mint/http2.ex +++ b/lib/mint/http2.ex @@ -91,7 +91,12 @@ defmodule Mint.HTTP2 do ] = responses promised_headers - #=> [{":method", "GET"}, {":path", "/style.css"}] + #=> [ + #=> {":method", "GET"}, + #=> {":scheme", "https"}, + #=> {":authority", "example.com"}, + #=> {":path", "/style.css"} + #=> ] As you can see in the example above, when the server sends a push promise then a `:push_promise` response is returned as a response to a request. The `:push_promise` @@ -100,7 +105,12 @@ defmodule Mint.HTTP2 do `promised_headers` are headers that tell the client *what request* the promised response will respond to. The idea is that the server tells the client a request the client will want to make and then preemptively sends a response for that request. Promised headers - will always include `:method`, `:path`, and `:authority`. + will always include `:method`, `:scheme`, `:authority`, and `:path`. + + A server may only push responses for origins it's authoritative for (RFC 9113 8.4). + Mint doesn't check this. Before using a pushed response, for example to cache it, + compare `:scheme` and `:authority` with the origin you connected to, and cancel the + promised request with `cancel_request/2` if they don't match. next_message = receive do