What happened?
xquic\src\http3\xqc_h3_header.c:458-509`（xqc_h3_hdr_is_forbidden）
描述：xquic 的 xqc_h3_hdr_is_forbidden 函数明确不禁止 connection 和 upgrade 头部，代码注释说明这是为了支持 WebSocket-over-HTTP/3：
/**
- RFC 9114 Section 4.2: reject connection-specific headers in HTTP/3.
- Forbidden: keep-alive, proxy-connection, transfer-encoding.
- Exception: "te" is allowed with value "trailers" only.
- "connection" and "upgrade" are intentionally NOT forbidden here to
- support the WebSocket-over-HTTP/3 scheme, which maps the RFC 6455
- upgrade handshake (Connection: Upgrade + Upgrade: websocket) onto
- HTTP/3 HEADERS frames. If we migrate to WebTransport (RFC 9220,
- Extended CONNECT), these two headers become unnecessary and this
- exemption should be removed.
*/
xqc_bool_t
xqc_h3_hdr_is_forbidden(const unsigned char *name, size_t nlen,
const unsigned char value, size_t vlen)
{
switch (nlen) {
case 2:
/ "te" - allowed only if value is exactly "trailers" (RFC 9114 §4.2) /
/ ... /
case 10:
/ "keep-alive" /
/ ... /
case 16:
/ "proxy-connection" /
/ ... /
case 17:
/ "transfer-encoding" /
/ ... */
}
return XQC_FALSE;
}
根据 RFC 9114 §4.2，`connection` 头部是 connection-specific 字段，**MUST** 被禁止。`upgrade` 头部与 HTTP Upgrade 机制相关，根据 RFC 9114 §4.5，HTTP/3 不支持 HTTP Upgrade 机制。
影响：违反 RFC 9114 §4.2 和 §4.5 的 MUST 要求。虽然这是为了支持 WebSocket-over-HTTP/3 的有意设计，但不符合 RFC 9114 标准。标准的方式应该使用 Extended CONNECT（RFC 9220）。
*nghttp3 对比：nghttp3 的 `http_request_on_header`（`nghttp3_http.c:414-419`）和 `http_response_on_header`（`nghttp3_http.c:512-517`）明确禁止 `connection`、`keep-alive`、`proxy-connection`、`transfer-encoding`、`upgrade` 头部：
case NGHTTP3_QPACK_TOKEN_CONNECTION:
case NGHTTP3_QPACK_TOKEN_KEEP_ALIVE:
case NGHTTP3_QPACK_TOKEN_PROXY_CONNECTION:
case NGHTTP3_QPACK_TOKEN_TRANSFER_ENCODING:
case NGHTTP3_QPACK_TOKEN_UPGRADE:
return NGHTTP3_ERR_MALFORMED_HTTP_HEADER;
`
### Steps To Reproduce
Information and Steps to reproduce the behavior.
### Relevant log output
```shell
What happened?
xquic\src\http3\xqc_h3_header.c:458-509`（xqc_h3_hdr_is_forbidden）
描述：xquic 的
xqc_h3_hdr_is_forbidden函数明确不禁止connection和upgrade头部，代码注释说明这是为了支持 WebSocket-over-HTTP/3：/**
*/
xqc_bool_t
xqc_h3_hdr_is_forbidden(const unsigned char *name, size_t nlen,
const unsigned char value, size_t vlen)
{
switch (nlen) {
case 2:
/ "te" - allowed only if value is exactly "trailers" (RFC 9114 §4.2) /
/ ... /
case 10:
/ "keep-alive" /
/ ... /
case 16:
/ "proxy-connection" /
/ ... /
case 17:
/ "transfer-encoding" /
/ ... */
}
return XQC_FALSE;
}