v0.19: HTTP bug fixes #1503

jay · 2026-09-18T16:18:30Z

jay commented

2026-09-18 16:18:30 +00:00

Bug fixes for HTTP std module:

Validate request-line syntax, header names/values and line endings; normalize header case and whitespace. Return 400 for request-head protocol errors without reclassifying application errors.
Require one Host for HTTP/1.1 and reject duplicate Host fields. Validate decimal Content-Length values and agreement between duplicates. Reject Transfer-Encoding/Content-Length conflicts and unsupported transfer codings; only a single chunked coding is supported.
Send 100 Continue before body reads for HTTP/1.1 requests with a single case-insensitive Expect: 100-continue field and positive Content-Length or chunked framing. Invalid heads receive no acknowledgment; other Expect forms remain ignored.
In a separate commit, fix the client to consume interim 100 Continue responses and return the final response. Preserve WebSocket 101 handling.

Public request/response structures are unchanged.

Tests

Server: 29/43 before → 110/110 after, fixing all 14 existing failures and adding 67 regression cases.
HTTP client, chunked I/O and WebSocket: 8/8 before → 10/10 after, including two new client regressions for fixed-length and chunked final responses.
After: 120/120 in both source and optimized modes.

Benchmark

One sequential before/after pair: f0badc77 without this PR’s fixes versus current b9892378. Verified prebuilt executables were reused; no rebuild was performed for this rerun.

Ryzen 9 7940HS/Linux host
Vegeta 12.13.0
50 requests/s
four workers/connections
keepalive disabled
5 seconds of warmup, 30 seconds of measurement

Latencies are milliseconds; p95/p99 are the 95th/99th percentiles.

Workload	Before median / p95 / p99	After median / p95 / p99	Requests/s before → after
Simple GET	0.677 / 1.092 / 1.865	0.635 / 1.047 / 1.341	50.031 → 50.033
Chunked GET	0.766 / 1.192 / 1.662	0.772 / 1.198 / 1.514	50.032 → 50.032
12-byte echo	0.757 / 1.171 / 1.886	0.774 / 1.160 / 1.575	50.031 → 50.032
1 MiB echo	4.019 / 4.454 / 5.461	4.070 / 4.384 / 5.055	50.027 → 50.027

All 14,000 requests, including warmups, returned HTTP 200 with no errors or timeouts. Median latency changes ranged from -6.2% to +2.3% in this pair; p99 decreased across all four workloads. Mean CPU utilization was 5.75% before and 5.70% after. This single fixed-load comparison is not a capacity test or proof of performance neutrality.

Bug fixes for HTTP std module: - Validate request-line syntax, header names/values and line endings; normalize header case and whitespace. Return `400` for request-head protocol errors without reclassifying application errors. - Require one `Host` for HTTP/1.1 and reject duplicate Host fields. Validate decimal `Content-Length` values and agreement between duplicates. Reject `Transfer-Encoding`/`Content-Length` conflicts and unsupported transfer codings; only a single `chunked` coding is supported. - Send `100 Continue` before body reads for HTTP/1.1 requests with a single case-insensitive `Expect: 100-continue` field and positive `Content-Length` or chunked framing. Invalid heads receive no acknowledgment; other Expect forms remain ignored. - In a separate commit, fix the client to consume interim `100 Continue` responses and return the final response. Preserve WebSocket `101` handling. Public request/response structures are unchanged. ## Tests - Server: **29/43 before → 110/110 after**, fixing all 14 existing failures and adding 67 regression cases. - HTTP client, chunked I/O and WebSocket: **8/8 before → 10/10 after**, including two new client regressions for fixed-length and chunked final responses. - After: **120/120 in both source and optimized modes**. ## Benchmark One sequential before/after pair: `f0badc77` without this PR’s fixes versus current `b9892378`. Verified prebuilt executables were reused; no rebuild was performed for this rerun. - Ryzen 9 7940HS/Linux host - Vegeta 12.13.0 - 50 requests/s - four workers/connections - keepalive disabled - 5 seconds of warmup, 30 seconds of measurement Latencies are milliseconds; p95/p99 are the 95th/99th percentiles. | Workload | Before median / p95 / p99 | After median / p95 / p99 | Requests/s before → after | |---|---:|---:|---:| | Simple GET | 0.677 / 1.092 / 1.865 | 0.635 / 1.047 / 1.341 | 50.031 → 50.033 | | Chunked GET | 0.766 / 1.192 / 1.662 | 0.772 / 1.198 / 1.514 | 50.032 → 50.032 | | 12-byte echo | 0.757 / 1.171 / 1.886 | 0.774 / 1.160 / 1.575 | 50.031 → 50.032 | | 1 MiB echo | 4.019 / 4.454 / 5.461 | 4.070 / 4.384 / 5.055 | 50.027 → 50.027 | All **14,000 requests**, including warmups, returned HTTP 200 with no errors or timeouts. Median latency changes ranged from -6.2% to +2.3% in this pair; p99 decreased across all four workloads. Mean CPU utilization was 5.75% before and 5.70% after. This single fixed-load comparison is not a capacity test or proof of performance neutrality.

jay added 11 commits

2026-09-18 16:18:30 +00:00

fix(http): Reject malformed request lines f7e385cdce

Keep parser failures separate from transport and application errors.

fix(http): Normalize header names and whitespace b6b4c029da

fix(http): Reject invalid field-name tokens 6f707e941b

fix(http): Reject invalid field-value controls f99aaf35bc

fix(http): Reject malformed line endings 133ae5b424

fix(http): Reject missing and duplicate Host 22c2df0fb1

fix(http): Validate decimal Content-Length values 8b10ad2aa5

fix(http): Reject conflicting request framing ab0871d456

fix(http): Send Continue before request body reads b94898e913

docs(http): Record final Phase 1 evidence 2c0eac614f

Merge v0.19-staging into HTTP fixes aae0055487

jay added 1 commit

2026-09-18 16:20:08 +00:00

delete plan.md 5f037bea5b

jay added 1 commit

2026-09-18 16:20:49 +00:00

delete performance.md 2dd800c6bf

jay requested reviews from vyzo, fare, HMarcien

2026-09-18 16:37:17 +00:00

jay changed title from ~~WIP: v0.19: HTTP bug fixes~~ to v0.19: HTTP bug fixes

2026-09-18 16:37:31 +00:00

vyzo requested changes

2026-09-18 17:36:24 +00:00

Dismissed

vyzo left a comment

I request some changes, the code can become better.

The main request is to have a base error class for the errors that result in 400 so that we don't have to check all of them exhaustively. that's a code quality issue.

I also left some comments about potential optimizations, i think it is worth doing them to avoid some allocations and astra can handle it.

I request some changes, the code can become better. The main request is to have a base error class for the errors that result in 400 so that we don't have to check all of them exhaustively. that's a code quality issue. I also left some comments about potential optimizations, i think it is worth doing them to avoid some allocations and astra can handle it.

👍 1

src/std/net/http/common/ioutil.ss Outdated

					
				@ -73,0 +86,4 @@

				               (and ;; string-split drops an empty final field after a trailing SP.

				                    (not (char=? (string-ref line (fx1- (string-length line))) #\space))

				                    (fx> method-length 0)

				                    (let loop ((i 0 :- :fixnum))

i think a better way to validate the method is to have a statically constructed hash table with method tables and just lookup there, no need to parse it at all. the methods are defined by the standard anyway.

src/std/net/http/common/ioutil.ss Outdated

					
				@ -155,0 +242,4 @@

				                                   where: read-header!)))

				                (validate (fx1+ i))))

				            (cons key

				                  (let trim-right ((stop end :- :fixnum))

i have the feeling this could be made more efficient by fusing with the header read loop. we could avoid the intermediate string allocation and the substring.

src/std/net/http/server/request.ss Outdated

					
				@ -20,0 +19,4 @@

				        new-response-handler

				        validate-request-host!

				        request-content-length

				        MalformedHost

you can struct-out export all the error classes.

src/std/net/http/server/request.ss Outdated

					
				@ -20,0 +26,4 @@

				        MalformedRequestFraming

				        MalformedRequestFraming?)

				(deferror-class (MalformedHost IOError) ())

if all these result to the same error code (400) you can make a base error class and inherit from there. this also goes for the other utility error classes.

src/std/net/http/server/server.ss Outdated

					
				@ -281,1 +312,3 @@

				                                  (cut display-exception e <>))))

				       (try

				        (if (and reading-request-head?

				                 (or (MalformedRequestLine? e)

here the base error class comes handy, no need for 10 or cases, just check the base class predicate.

vyzo reviewed

2026-09-18 20:28:44 +00:00

src/std/net/http/common/ioutil.ss Outdated

					
				@ -73,0 +107,4 @@

				                    (char<=? #\0 (string-ref proto 5) #\9)

				                    (char=? (string-ref proto 6) #\.)

				                    (char<=? #\0 (string-ref proto 7) #\9))

				             (raise/context (MalformedRequestLine "invalid request line" irritants: [line])

you should define a raise macro with defraise/context and use it, it handles things nicely and most importantly puts the abort annotation that informs the compiler that it is a computational cut.

same for all the raises of input errors.

you should define a raise macro with defraise/context and use it, it handles things nicely and most importantly puts the abort annotation that informs the compiler that it is a computational cut. same for all the raises of input errors.

jay added 2 commits

2026-09-18 23:45:34 +00:00

refactor(http): streamline request-head parsing 607f4131c4

fix(http): skip interim 100 responses in client b98923783d

jay commented

2026-09-19 00:06:36 +00:00

@vyzo addressed your feedback. apologies for not reviewing this more before opening, I was on the road earlier and just pushed what I had!

jay requested review from vyzo

2026-09-19 00:06:41 +00:00

vyzo commented

2026-09-19 06:05:51 +00:00

hey no worries, that's what review is for. astra is a great programmer, but still needs some advice.