actix-http-v3.18.13

Key Highlights

• Enforces strict validation for WebSocket handshakes, rejecting invalid Base64 keys and oversized Close frame payloads.
• Improves HTTP/1 Connection header parsing to ensure consistency in upgrade advertisement handling.
• Corrects Expect header logic to strictly apply to HTTP/1.1 requests.
• Returns a 426 Upgrade Required response for unsupported WebSocket versions.

New Features

• Emit required Connection options for HTTP/1 response upgrade advertisements without changing connection state.
• Parse all HTTP/1 Connection header options consistently.
• Only treat Expect: 100-continue as a continue expectation in HTTP/1.1 requests.
• Reject WebSocket handshakes with invalid Sec-WebSocket-Key values.
• Reject WebSocket Close frames with payloads larger than 125 bytes.
• Return a 426 Upgrade Required response for unsupported WebSocket versions.

Full Release Notes

- Emit required `Connection` options for HTTP/1 response upgrade advertisements without changing connection state.
- Parse all HTTP/1 `Connection` header options consistently.
- Only treat `Expect: 100-continue` as a continue expectation in HTTP/1.1 requests.
- Reject WebSocket handshakes with a `Sec-WebSocket-Key` value that is not valid Base64 or does not decode to 16 bytes.
- Reject WebSocket Close frames with payloads larger than 125 bytes.
- Return a 426 Upgrade Required response when an unsupported WebSocket version is requested.

Related Repositories