v25.10.7

changelog.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 2026-03-12 - 25.10.7 - fix(rustproxy-http)
+remove Host header from HTTP/2 upstream requests while preserving it for HTTP/1 retries
+
+- strips the Host header before sending HTTP/2 upstream requests so :authority from the URI is used instead
+- avoids 400 responses from nginx caused by sending both Host and :authority headers
+- keeps a cloned header set for bodyless request retries so HTTP/1 fallback still retains the Host header
+
+## 2026-03-12 - 25.10.6 - fix(rustproxy-http)
+use the requested domain as HTTP/2 authority instead of the backend host and port
+
+- build HTTP/2 absolute URIs from the client-facing domain so the :authority pseudo-header matches the Host header
+- remove backend port from generated HTTP/2 request URIs and fall back to the upstream host only when no domain is available
+- apply the authority handling consistently across pooled, inline, and generic upstream request paths
+
+## 2026-03-12 - 25.10.5 - fix(rustproxy-http)
+configure HTTP/2 client builders with a Tokio timer for keep-alive handling
+
+- Adds TokioTimer to all HTTP/2 client builder instances in proxy_service.
+- Ensures configured HTTP/2 keep-alive interval and timeout settings have the required timer runtime support.
+
 ## 2026-03-12 - 25.10.4 - fix(rustproxy-http)
 stabilize upstream HTTP/2 forwarding and fallback behavior
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "25.10.4",
+  "version": "25.10.7",
   "private": false,
   "description": "A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.",
   "main": "dist_ts/index.js",

rust/crates/rustproxy-http/src/proxy_service.rs

@@ -912,6 +912,7 @@ impl HttpProxyService {
         let exec = hyper_util::rt::TokioExecutor::new();
         let mut h2_builder = hyper::client::conn::http2::Builder::new(exec);
         h2_builder
+            .timer(hyper_util::rt::TokioTimer::new())
             .keep_alive_interval(std::time::Duration::from_secs(10))
             .keep_alive_timeout(std::time::Duration::from_secs(5))
             .adaptive_window(true)
@@ -1052,6 +1053,7 @@ impl HttpProxyService {
         let exec = hyper_util::rt::TokioExecutor::new();
         let mut h2_builder = hyper::client::conn::http2::Builder::new(exec);
         h2_builder
+            .timer(hyper_util::rt::TokioTimer::new())
             .keep_alive_interval(std::time::Duration::from_secs(10))
             .keep_alive_timeout(std::time::Duration::from_secs(5))
             .adaptive_window(true)
@@ -1082,13 +1084,17 @@ impl HttpProxyService {
         });
 
         // Build request with empty body using absolute URI for H2 pseudo-headers
-        let h2_uri = format!("{}://{}:{}{}",
-            if pool_key.use_tls { "https" } else { "http" },
-            pool_key.host, pool_key.port, upstream_path);
+        let scheme = if pool_key.use_tls { "https" } else { "http" };
+        let authority = if domain != "-" { domain } else { pool_key.host.as_str() };
+        let h2_uri = format!("{}://{}{}", scheme, authority, upstream_path);
         let mut upstream_req = Request::builder()
             .method(method)
             .uri(&h2_uri);
 
+        // Remove Host header for H2 — :authority pseudo-header (from URI) is sufficient
+        let mut upstream_headers = upstream_headers;
+        upstream_headers.remove("host");
+
         if let Some(headers) = upstream_req.headers_mut() {
             *headers = upstream_headers;
         }
@@ -1129,7 +1135,7 @@ impl HttpProxyService {
         io: TokioIo<BackendStream>,
         parts: hyper::http::request::Parts,
         body: Incoming,
-        upstream_headers: hyper::HeaderMap,
+        mut upstream_headers: hyper::HeaderMap,
         upstream_path: &str,
         upstream: &crate::upstream_selector::UpstreamSelection,
         route: &rustproxy_config::RouteConfig,
@@ -1142,6 +1148,7 @@ impl HttpProxyService {
         let exec = hyper_util::rt::TokioExecutor::new();
         let mut h2_builder = hyper::client::conn::http2::Builder::new(exec);
         h2_builder
+            .timer(hyper_util::rt::TokioTimer::new())
             .keep_alive_interval(std::time::Duration::from_secs(10))
             .keep_alive_timeout(std::time::Duration::from_secs(5))
             .adaptive_window(true)
@@ -1199,18 +1206,22 @@ impl HttpProxyService {
                 });
 
                 // Save retry state before consuming parts/body (for bodyless requests like GET)
+                // Clone BEFORE removing Host — H1 fallback needs Host header
                 let retry_state = if body.is_end_stream() {
                     Some((parts.method.clone(), upstream_headers.clone()))
                 } else {
                     None
                 };
 
+                // Remove Host header for H2 — :authority pseudo-header (from URI) is sufficient
+                upstream_headers.remove("host");
+
                 // Build and send the h2 request inline (don't register in pool yet —
                 // we need to verify the request actually succeeds first, because some
                 // backends advertise h2 via ALPN but don't speak the h2 binary protocol).
-                let h2_uri = format!("{}://{}:{}{}",
-                    if upstream.use_tls { "https" } else { "http" },
-                    upstream.host, upstream.port, upstream_path);
+                let scheme = if upstream.use_tls { "https" } else { "http" };
+                let authority = if domain != "-" { domain } else { upstream.host.as_str() };
+                let h2_uri = format!("{}://{}{}", scheme, authority, upstream_path);
                 let mut upstream_req = Request::builder()
                     .method(parts.method)
                     .uri(&h2_uri);
@@ -1461,17 +1472,21 @@ impl HttpProxyService {
         domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         // Build absolute URI for H2 pseudo-headers (:scheme, :authority)
-        let h2_uri = if let Some(pk) = pool_key {
-            format!("{}://{}:{}{}",
-                if pk.use_tls { "https" } else { "http" },
-                pk.host, pk.port, upstream_path)
-        } else {
-            upstream_path.to_string()
+        // Use the requested domain as authority (not backend address) so :authority matches Host header
+        let scheme = if pool_key.map(|pk| pk.use_tls).unwrap_or(false) { "https" } else { "http" };
+        let authority = if domain != "-" { domain } else {
+            pool_key.map(|pk| pk.host.as_str()).unwrap_or("localhost")
         };
+        let h2_uri = format!("{}://{}{}", scheme, authority, upstream_path);
         let mut upstream_req = Request::builder()
             .method(parts.method)
             .uri(&h2_uri);
 
+        // Remove Host header for H2 — :authority pseudo-header (from URI) is sufficient
+        // Having both Host and :authority causes nginx to return 400
+        let mut upstream_headers = upstream_headers;
+        upstream_headers.remove("host");
+
         if let Some(headers) = upstream_req.headers_mut() {
             *headers = upstream_headers;
         }

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '25.10.4',
+  version: '25.10.7',
   description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 }