HTTP/2, load balancers and the ambiguous ":scheme" header

Philipp Hossner, a Staff Engineer at DeepL, discusses a technical issue encountered when transitioning to a new load balancer for an HTTP/2 web application, which resulted in 502 errors due to a mismatch between the :scheme header expectations of the load balancer and the web server. The problem arose because the new load balancer set the :scheme header to "https" while the web application, using ASP.NET Kestrel, expected "http" due to terminated TLS connections, leading to protocol errors. The root cause was traced back to the load balancer's handling of the :scheme header, a design choice inherited from SPDY that isn't strictly necessary for server requests. The solution involved enabling the AllowAlternateSchemes option in Kestrel to accommodate alternate :scheme values, avoiding the need to alter the load balancer's behavior. This experience highlighted the importance of packet captures in diagnosing network issues and the variability in RFC-compliant software behavior.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.