Honor jdk.httpclient.allowRestrictedHeaders in Http2Client (#2975)#3419
Merged
velo merged 1 commit intoJun 17, 2026
Merged
Conversation
…#2975) The new Java HttpClient lets callers opt in to setting otherwise restricted headers (such as Host) via the jdk.httpclient.allowRestrictedHeaders system property. Http2Client kept its own static DISALLOWED_HEADERS_SET and stripped those headers before handing the request to the JDK client, so the opt-in had no effect and the header was silently dropped. Mirror jdk.internal.net.http.common.Utils#getDisallowedHeaders() by removing any headers listed in the property from the disallowed set. Signed-off-by: seonwoo_jung <79202163+seonwooj0810@users.noreply.github.com>
velo
approved these changes
Jun 17, 2026
velo
left a comment
Member
There was a problem hiding this comment.
This is a clean fix for the Http2Client restricted-header filtering. The new tests cover the default restricted set and the opt-in system property behavior, and the change stays internal to the Java 11 client without compatibility or security concerns.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2975
Problem
The JDK
HttpClientlets callers opt in to sending otherwise restricted headers (e.g.Host,Connection) by setting thejdk.httpclient.allowRestrictedHeaderssystem property. HoweverHttp2Clientkeeps its own hard-codedDISALLOWED_HEADERS_SETand strips those headers infilterRestrictedHeaders(...)before the request reaches the JDK client. As a result, even with-Djdk.httpclient.allowRestrictedHeaders=hosttheHostheader is silently dropped and Feign sends the host derived from the URL instead.Change
Http2Clientnow mirrorsjdk.internal.net.http.common.Utils#getDisallowedHeaders(): any header listed (comma-separated) in thejdk.httpclient.allowRestrictedHeaderssystem property is removed from the disallowed set, so opting in at the JDK level is no longer defeated by Feign's own filter. Default behavior (property unset) is unchanged — all ofconnection, content-length, expect, host, upgraderemain filtered.The header-set construction was extracted into a package-private
disallowedHeaders(String)method to keep it pure and unit-testable.Test evidence
Added
Http2ClientHeadersTestcovering the default set, single-header opt-in, and multi-header/case-insensitive/whitespace handling:Code format validated via
git-code-format-maven-plugin:validate-code-format(BUILD SUCCESS).Verification done: confirmed bug pattern still on master (static
DISALLOWED_HEADERS_SETstrips headers unconditionally); no in-flight PR or linked branch for #2975; no self-claim in thread (maintainer invited a PR with tests on 2026-06-04); change is code-only in.java; commit carries DCO sign-off.