How to close client HTTP/2 connections?

[filex]

Hello,

we use NGINX as http/2 and TLS offloader. Therefore it is responsible for
connection handling. (Most of the requests are proxy_pass'ed to upstream
servers. However, some few requests are served from local files.)

Now, I would like to close the client connection under certain
circumstances. That could be the presence of a certain upstream response
header or status code.

I have tried

more_set_headers -s '502 503' 'Connection: close';

This works for HTTP/1 connections.

However, this Connection header seems to be forbidden in h2. Triggering the
header with curl (-v --http2) yields an error:

http2 error: Invalid HTTP header field was received: frame type: 1,
stream: 1, name: [connection], value: [close]
curl: (92) HTTP/2 stream 1 was not closed cleanly: PROTOCOL_ERROR (err
1)

Ok, the connection is closed :) But quite elegantly.

And I forgot to mention that I would like to serve an error message, like a
"sorry…" HTML. (Therefore I couldn't use the 444 status.)

How could I do this for h2: Serve a last page and then say GOWAY?

Best regards,
Felix

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,282096,282096#msg-282096

[Olaf van der Spek]

Why do you want to do this?

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,282096,282099#msg-282099

[filex]

Post by Olaf van der Spek
Why do you want to do this?

In a cluster of many nginx servers we had one faulty node that was
delivering only errors. In that special case a default vhost replied an
"domain not configured" error, because the underlying configuration was
inaccessible. The health check was not firing, because such errors are
normal (bad bots try to access removed domains or simply make up host
headers).

A client that was round-robin balanced to that faulty nginx instance was
delivered the error page, but the connection was still active. Every
subsequent request to our domain had hit the same bad instance. The google
bot uses each connection for 100 requests. They all ran into the error. Same
for browsers: When you hit reload, you will run into the same problem until
the connection times out.

If the connection was closed immediately there would be a good chance to be
load-balanced to another instance.

In http/1 "Connection: close" does the job. but most of our traffic is h2.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,282096,282101#msg-282101

[Olaf van der Spek]

Closing the connection wouldn't really solve the issue would it?

There has to be a better way to solve this.

Posted at Nginx Forum: https://forum.nginx.org/read.php?2,282096,282104#msg-282104