ERR_SPDY_PROTOCOL_ERROR when Akamai Pragma Headers extension in use
Reported by
pkenned...@gmail.com,
Sep 29
|
|||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36 Example URL: https://www.barnesandnoble.com/ Steps to reproduce the problem: 1. Browse to https://www.barnesandnoble.com/ 2. Now install Pragma Header 3. Go to https://www.barnesandnoble.com/ and you will get the ERR_SPDY error What is the expected behavior? The site should load What went wrong? It seems that a lot of sites display that error when i have Pragma Headers extension installed. Flushing sockets, removing temp files, flushing DNS etc does not fix it. Disabling the extension does. Does it occur on multiple sites: Yes Is it a problem with a plugin? N/A Did this work before? Yes not sure Does this work in other browsers? N/A Chrome version: 69.0.3497.100 Channel: stable OS Version: 10.0 Flash Version:
,
Sep 30
The headers I am using ar: akamai-x-cache-on, akamai-x-cache-remote-on, akamai-x-check-cacheable, akamai-x-get-cache-key, akamai-x-get-extracted-values, akamai-x-get-nonces, akamai-x-get-ssl-client-session-id, akamai-x-get-true-cache-key, akamai-x-serial-no, akamai-x-get-request-id, akamai-x-request-trace, akamai-x--meta-trace, akama-xi-get-extracted-values I removed them one by one, and determined that the header causing the issue is the akamai-x-get-extracted-values, that I found on the Akamai help pages. akamai-xi-get-extracted-values works, however the offending header is: akamai-x-get-extracted-values I have confirmed this from multiple browsers.
,
Sep 30
,
Oct 1
Unable to reproduce the issue on chrome reported version# 69.0.3497.100 using Windows-10 with steps mentioned below: 1) Launched chrome reported version and navigated to URL: https://www.barnesandnoble.com/ 2) Site loaded successfully, installed Pragma Header and again navigated to URL: https://www.barnesandnoble.com/ 3) Able to see site loaded successfully. @Reporter: Please find the attached screencast for your reference and let us know if we missed anything in reproducing the issue, provide your feedback on it which help in further triaging it in better way. Thanks!
,
Oct 1
Sorry, I added a second comment on the step i failed to mention. After installing pragma headers, you must configure it to use which ever headers you want, then restart chrome, then browse to bn.com, rydercup.com, www.shoprite.com, etc. The header that seemed to be causing the issue was: akamai-x-get-extracted-values When i removed that, and restarted, things returned to normal. I am fine with the following headers configured: akamai-x-cache-on, akamai-x-cache-remote-on, akamai-x-check-cacheable, akamai-x-get-cache-key, akamai-x-get-nonces, akamai-x-get-ssl-client-session-id, akamai-x-get-true-cache-key, akamai-x-serial-no, akamai-x-get-request-id, akamai-x-request-trace, akamai-x--meta-trace, akama-xi-get-extracted-values
,
Oct 1
Here's a recording of it.
,
Oct 1
,
Oct 2
The error occurs because an invalid response header field is received from the server. I can reproduce by adding "Pragma: akamai-x-get-extracted-values" to the request and visiting https://www.barnesandnoble.com. The offending header field (percent-encoded) is: header_name = "x-akamai-session-info" header_value = "name=RUA_TAP_C;%20value=%3Chttps%1F//page.cdnbasket.net%3E;rel=%22preconnect%22,%3Chttps%1F//px.dynamicyield.com%3E;rel=%22preconnect%22,%3Chttps%1F//prodimage.images-bn.com%3E;rel=%22preconnect%22,%3Chttps%1F//assets.bounceexchange.com%3E;rel=%22preconnect%22" Here the character %1F in the header value is invalid. RFC 7540 Section 10.3 states that "Any request or response that contains a character not permitted in a header field value MUST be treated as malformed (Section 8.1.2.6). Valid characters are defined by the field-content ABNF rule in Section 3.2 of [RFC7230].". RFC 7230 Section 3.2 says: field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ] field-vchar = VCHAR / obs-text RFC 5234 Appendix B.1 defines |VCHAR|: VCHAR = %x21-7E RFC 7230 Section 3.2.6 defines |obs-text|: obs-text = %x80-FF Turns out %x1F is neither obs-text nor VCHAR nor SP nor HTAB, therefore it is invalid. On Chrome's end, this is working as intended. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by chrishtr@chromium.org
, Sep 29