feat: http/2 listener support

package.json

@@ -53,6 +53,7 @@
     "sse": "^0.0.8",
     "typescript": "^5.9.3",
     "unbuild": "^3.6.1",
+    "undici": "^7.21.0",
     "vitest": "^4.0.18",
     "ws": "^8.19.0"
   },

src/_utils.ts

@@ -1,8 +1,8 @@
 import httpNative from "node:http";
 import httpsNative from "node:https";
 import net from "node:net";
-import type tls from "node:tls";
 import type { ProxyAddr, ProxyServerOptions, ProxyTarget, ProxyTargetDetailed } from "./types.ts";
+import type { Http2ServerRequest } from "node:http2";
 
 const upgradeHeader = /(^|,)\s*upgrade\s*($|,)/i;
 
@@ -11,6 +11,15 @@ const upgradeHeader = /(^|,)\s*upgrade\s*($|,)/i;
  */
 export const isSSL = /^https|wss/;
 
+/**
+ * Node.js HTTP/2 accepts pseudo headers and it may conflict
+ * with request options.
+ *
+ * Let's just blacklist those potential conflicting pseudo
+ * headers.
+ */
+const HTTP2_HEADER_BLACKLIST = [":method", ":path", ":scheme", ":authority"];
+
 /**
  * Copies the right headers from `options` and `req` to
  * `outgoing` which is then used to fire the proxied
@@ -38,7 +47,7 @@ export function setupOutgoing(
     ca?: string;
     method?: string;
   },
-  req: httpNative.IncomingMessage,
+  req: httpNative.IncomingMessage | Http2ServerRequest,
   forward?: "forward" | "target",
 ): httpNative.RequestOptions | httpsNative.RequestOptions {
   outgoing.port =
@@ -64,10 +73,23 @@ export function setupOutgoing(
   outgoing.method = options.method || req.method;
   outgoing.headers = { ...req.headers };
 
+  // before clean up HTTP/2 blacklist header, we might wanna override host first
+  if (req.headers?.[":authority"]) {
+    outgoing.headers.host = req.headers[":authority"] as string;
+  }
+  // host override must happen before composing/merging the final outgoing headers
+
   if (options.headers) {
     outgoing.headers = { ...outgoing.headers, ...options.headers };
   }
 
+  if (req.httpVersionMajor > 1) {
+    // ignore potential conflicting HTTP/2 pseudo headers
+    for (const header of HTTP2_HEADER_BLACKLIST) {
+      delete outgoing.headers[header];
+    }
+  }
+
   if (options.auth) {
     outgoing.auth = options.auth;
   }
@@ -181,8 +203,9 @@ export function setupSocket(socket: net.Socket): net.Socket {
  *
  * @api private
  */
-export function getPort(req: httpNative.IncomingMessage): string {
-  const res = req.headers.host ? req.headers.host.match(/:(\d+)/) : "";
+export function getPort(req: httpNative.IncomingMessage | Http2ServerRequest): string {
+  const hostHeader = (req.headers[":authority"] as string | undefined) || req.headers.host;
+  const res = hostHeader ? hostHeader.match(/:(\d+)/) : "";
   if (res) {
     return res[1]!;
   }
@@ -198,11 +221,43 @@ export function getPort(req: httpNative.IncomingMessage): string {
  *
  * @api private
  */
-export function hasEncryptedConnection(req: httpNative.IncomingMessage): boolean {
-  return Boolean(
-    // req.connection.pair probably does not exist anymore
-    (req.connection as tls.TLSSocket).encrypted || (req.connection as any).pair,
-  );
+export function hasEncryptedConnection(
+  req: httpNative.IncomingMessage | Http2ServerRequest,
+): boolean {
+  // Since Node.js v16 we now have req.socket
+  if ("socket" in req) {
+    /* v8 ignore start */
+
+    // encrypted is only present in TLS sockets, not plain net sockets
+    if ("encrypted" in req.socket) {
+      return req.socket.encrypted;
+    }
+
+    // "pair" is deprecated and is not typed by @types/node, but it actually hasn't been removed yet
+    // we can still fall back to "pair" for backward compatibility, but normally not reachable
+    if ("pair" in req.socket) {
+      return !!req.socket.pair;
+    }
+    /* v8 ignore stop */
+  }
+
+  if ("connection" in req) {
+    /* v8 ignore start */
+
+    // encrypted is only present in TLS sockets, not plain net sockets
+    if ("encrypted" in req.connection) {
+      return req.connection.encrypted;
+    }
+
+    // "pair" is deprecated and is not typed by @types/node, but it actually hasn't been removed yet
+    // we can still fall back to "pair" for backward compatibility, but normally not reachable
+    if ("pair" in req.connection) {
+      return !!req.connection.pair;
+    }
+    /* v8 ignore stop */
+  }
+
+  return false;
 }
 
 /**

src/middleware/_utils.ts

@@ -2,25 +2,26 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Socket } from "node:net";
 import type { ProxyServer } from "../server.ts";
 import type { ProxyServerOptions, ProxyTargetDetailed } from "../types.ts";
+import type { Http2ServerRequest, Http2ServerResponse } from "node:http2";
 
 export type ResOfType<T extends "web" | "ws"> = T extends "ws"
   ? T extends "web"
-    ? ServerResponse | Socket
+    ? ServerResponse | Http2ServerResponse | Socket
     : Socket
   : T extends "web"
-    ? ServerResponse
+    ? ServerResponse | Http2ServerResponse
     : never;
 
-export type ProxyMiddleware<T extends ServerResponse | Socket> = (
-  req: IncomingMessage,
+export type ProxyMiddleware<T extends ServerResponse | Http2ServerResponse | Socket> = (
+  req: IncomingMessage | Http2ServerRequest,
   res: T,
   opts: ProxyServerOptions & {
     target: URL | ProxyTargetDetailed;
     forward: URL;
   },
-  server: ProxyServer,
+  server: ProxyServer<IncomingMessage | Http2ServerRequest, ServerResponse | Http2ServerResponse>,
   head?: Buffer,
-  callback?: (err: any, req: IncomingMessage, socket: T, url?: any) => void,
+  callback?: (err: any, req: IncomingMessage | Http2ServerRequest, socket: T, url?: any) => void,
 ) => void | true;
 
 export function defineProxyMiddleware<T extends ServerResponse | Socket = ServerResponse>(
@@ -30,8 +31,8 @@ export function defineProxyMiddleware<T extends ServerResponse | Socket = Server
 }
 
 export type ProxyOutgoingMiddleware = (
-  req: IncomingMessage,
-  res: ServerResponse,
+  req: IncomingMessage | Http2ServerRequest,
+  res: ServerResponse | Http2ServerResponse,
   proxyRes: IncomingMessage,
   opts: ProxyServerOptions & {
     target: URL | ProxyTargetDetailed;

src/middleware/web-incoming.ts

@@ -52,7 +52,8 @@ export const XHeaders = defineProxyMiddleware((req, res, options) => {
       values[header];
   }
 
-  req.headers["x-forwarded-host"] = req.headers["x-forwarded-host"] || req.headers.host || "";
+  req.headers["x-forwarded-host"] =
+    req.headers["x-forwarded-host"] || req.headers[":authority"] || req.headers.host || "";
 });
 
 /**

src/middleware/web-outgoing.ts

@@ -7,20 +7,26 @@ const redirectRegex = /^201|30([1278])$/;
  * If is a HTTP 1.0 request, remove chunk headers
  */
 export const removeChunked = defineProxyOutgoingMiddleware((req, res, proxyRes) => {
-  if (req.httpVersion === "1.0") {
+  // HTTP/1.0 and HTTP/2 do not have transfer-encoding: chunked
+  if (req.httpVersion !== "1.1") {
     delete proxyRes.headers["transfer-encoding"];
   }
 });
 
 /**
  * If is a HTTP 1.0 request, set the correct connection header
  * or if connection header not present, then use `keep-alive`
+ *
+ * If is a HTTP/2 request, remove connection header no matter what,
+ * this avoids sending connection header to the underlying http2 client
  */
 export const setConnection = defineProxyOutgoingMiddleware((req, res, proxyRes) => {
   if (req.httpVersion === "1.0") {
     proxyRes.headers.connection = req.headers.connection || "close";
-  } else if (req.httpVersion !== "2.0" && !proxyRes.headers.connection) {
+  } else if (req.httpVersionMajor < 2 && !proxyRes.headers.connection) {
     proxyRes.headers.connection = req.headers.connection || "keep-alive";
+  } else if (req.httpVersionMajor >= 2) {
+    delete proxyRes.headers.connection;
   }
 });
 
@@ -42,8 +48,12 @@ export const setRedirectHostRewrite = defineProxyOutgoingMiddleware(
 
       if (options.hostRewrite) {
         u.host = options.hostRewrite;
-      } else if (options.autoRewrite && req.headers.host) {
-        u.host = req.headers.host;
+      } else if (options.autoRewrite) {
+        if (req.headers[":authority"]) {
+          u.host = req.headers[":authority"] as string;
+        } else if (req.headers.host) {
+          u.host = req.headers.host;
+        }
       }
       if (options.protocolRewrite) {
         u.protocol = options.protocolRewrite;
@@ -116,13 +126,16 @@ export const writeHeaders = defineProxyOutgoingMiddleware((req, res, proxyRes, o
  */
 export const writeStatusCode = defineProxyOutgoingMiddleware((req, res, proxyRes) => {
   // From Node.js docs: response.writeHead(statusCode[, statusMessage][, headers])
-  if (proxyRes.statusMessage) {
-    // @ts-expect-error
-    res.statusCode = proxyRes.statusCode;
+
+  // @ts-expect-error
+  res.statusCode = proxyRes.statusCode;
+
+  if (
+    proxyRes.statusMessage &&
+    // Only HTTP/1.0 and HTTP/1.1 support statusMessage
+    req.httpVersionMajor < 2
+  ) {
     res.statusMessage = proxyRes.statusMessage;
-  } else {
-    // @ts-expect-error
-    res.statusCode = proxyRes.statusCode;
   }
 });