Upgrade request handling: ignore http/2 and optionally ignore websocket

docs/deployment.md

@@ -69,6 +69,9 @@ Options:
   --ws-per-message-deflate BOOLEAN
                                   WebSocket per-message-deflate compression
                                   [default: True]
+  --ws-ignore-upgrade BOOLEAN     Upgrade requests will be ignored and
+                                  answered with normal HTTP responses
+                                  [default: False]
   --lifespan [auto|on|off]        Lifespan implementation.  [default: auto]
   --interface [auto|asgi3|asgi2|wsgi]
                                   Select ASGI3, ASGI2, or WSGI as the

docs/index.md

@@ -136,6 +136,9 @@ Options:
   --ws-per-message-deflate BOOLEAN
                                   WebSocket per-message-deflate compression
                                   [default: True]
+  --ws-ignore-upgrade BOOLEAN     Upgrade requests will be ignored and
+                                  answered with normal HTTP responses
+                                  [default: False]
   --lifespan [auto|on|off]        Lifespan implementation.  [default: auto]
   --interface [auto|asgi3|asgi2|wsgi]
                                   Select ASGI3, ASGI2, or WSGI as the

docs/settings.md

@@ -71,6 +71,7 @@ Using Uvicorn with watchfiles will enable the following options (which are other
 * `--ws-max-size <int>` - Set the WebSockets max message size, in bytes. Please note that this can be used only with the default `websockets` protocol.
 * `--ws-ping-interval <float>` - Set the WebSockets ping interval, in seconds. Please note that this can be used only with the default `websockets` protocol.
 * `--ws-ping-timeout <float>` - Set the WebSockets ping timeout, in seconds. Please note that this can be used only with the default `websockets` protocol.
+* `--ws-ignore-upgrade` - Will ignore all upgrade requests and instead continue replying with HTTP responses.
 * `--lifespan <str>` - Set the Lifespan protocol implementation. **Options:** *'auto', 'on', 'off'.* **Default:** *'auto'*.
 * `--h11-max-incomplete-event-size <int>` - Set the maximum number of bytes to buffer of an incomplete event. Only available for `h11` HTTP protocol implementation. **Default:** *'16384'* (16 KB).
 

tests/protocols/test_http.py

@@ -76,6 +76,18 @@
     ]
 )
 
+UPGRADE_HTTP2_REQUEST = b"\r\n".join(
+    [
+        b"GET / HTTP/1.1",
+        b"Host: example.org",
+        b"Connection: upgrade",
+        b"Upgrade: h2c",
+        b"Sec-WebSocket-Version: 11",
+        b"",
+        b"",
+    ]
+)
+
 INVALID_REQUEST_TEMPLATE = b"\r\n".join(
     [
         b"%s",
@@ -716,6 +728,34 @@ async def test_supported_upgrade_request(protocol_cls):
     assert b"HTTP/1.1 426 " in protocol.transport.buffer
 
 
+@pytest.mark.anyio
+@pytest.mark.parametrize("protocol_cls", HTTP_PROTOCOLS)
+async def test_ignored_ws_upgrade_request(protocol_cls):
+    app = Response("Hello, world", media_type="text/plain")
+
+    protocol = get_connected_protocol(
+        app, protocol_cls, ws="wsproto", ws_ignore_upgrade=True
+    )
+    protocol.data_received(UPGRADE_REQUEST)
+    await protocol.loop.run_one()
+    assert b"HTTP/1.1 200 OK" in protocol.transport.buffer
+    assert b"Hello, world" in protocol.transport.buffer
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize("protocol_cls", HTTP_PROTOCOLS)
+async def test_http2_upgrade_request(protocol_cls):
+    app = Response("Hello, world", media_type="text/plain")
+
+    protocol = get_connected_protocol(
+        app, protocol_cls, ws="wsproto", ws_ignore_upgrade=True
+    )
+    protocol.data_received(UPGRADE_HTTP2_REQUEST)
+    await protocol.loop.run_one()
+    assert b"HTTP/1.1 200 OK" in protocol.transport.buffer
+    assert b"Hello, world" in protocol.transport.buffer
+
+
 async def asgi3app(scope, receive, send):
     pass
 

uvicorn/config.py

@@ -220,6 +220,7 @@ def __init__(
         ws_ping_interval: Optional[float] = 20.0,
         ws_ping_timeout: Optional[float] = 20.0,
         ws_per_message_deflate: bool = True,
+        ws_ignore_upgrade: bool = False,
         lifespan: LifespanType = "auto",
         env_file: Optional[Union[str, os.PathLike]] = None,
         log_config: Optional[Union[Dict[str, Any], str]] = LOGGING_CONFIG,
@@ -267,6 +268,7 @@ def __init__(
         self.ws_ping_interval = ws_ping_interval
         self.ws_ping_timeout = ws_ping_timeout
         self.ws_per_message_deflate = ws_per_message_deflate
+        self.ws_ignore_upgrade = ws_ignore_upgrade
         self.lifespan = lifespan
         self.log_config = log_config
         self.log_level = log_level

uvicorn/main.py

@@ -169,6 +169,13 @@ def print_version(ctx: click.Context, param: click.Parameter, value: bool) -> No
     help="WebSocket per-message-deflate compression",
     show_default=True,
 )
+@click.option(
+    "--ws-ignore-upgrade",
+    type=bool,
+    default=False,
+    help="Upgrade requests will be ignored and answered with normal HTTP responses",
+    show_default=True,
+)
 @click.option(
     "--lifespan",
     type=LIFESPAN_CHOICES,
@@ -367,6 +374,7 @@ def main(
     ws_ping_interval: float,
     ws_ping_timeout: float,
     ws_per_message_deflate: bool,
+    ws_ignore_upgrade: bool,
     lifespan: LifespanType,
     interface: InterfaceType,
     reload: bool,
@@ -414,6 +422,7 @@ def main(
         ws_ping_interval=ws_ping_interval,
         ws_ping_timeout=ws_ping_timeout,
         ws_per_message_deflate=ws_per_message_deflate,
+        ws_ignore_upgrade=ws_ignore_upgrade,
         lifespan=lifespan,
         env_file=env_file,
         log_config=LOGGING_CONFIG if log_config is None else log_config,
@@ -464,6 +473,7 @@ def run(
     ws_ping_interval: typing.Optional[float] = 20.0,
     ws_ping_timeout: typing.Optional[float] = 20.0,
     ws_per_message_deflate: bool = True,
+    ws_ignore_upgrade: bool = False,
     lifespan: LifespanType = "auto",
     interface: InterfaceType = "auto",
     reload: bool = False,
@@ -516,6 +526,7 @@ def run(
         ws_ping_interval=ws_ping_interval,
         ws_ping_timeout=ws_ping_timeout,
         ws_per_message_deflate=ws_per_message_deflate,
+        ws_ignore_upgrade=ws_ignore_upgrade,
         lifespan=lifespan,
         interface=interface,
         reload=reload,

uvicorn/protocols/http/h11_impl.py

@@ -155,6 +155,23 @@ def _unset_keepalive_if_required(self) -> None:
             self.timeout_keep_alive_task.cancel()
             self.timeout_keep_alive_task = None
 
+    def _should_upgrade(
+        self, headers: List[Tuple[bytes, bytes]], event: H11Event
+    ) -> bool:
+        connection = []
+        upgrade = None
+        for name, value in headers:
+            if name == b"connection":
+                connection = [token.lower().strip() for token in value.split(b",")]
+            if name == b"upgrade":
+                upgrade = value.lower().strip()
+
+        return (
+            b"upgrade" in connection
+            and upgrade == b"websocket"
+            and not self.config.ws_ignore_upgrade
+        )
+
     def data_received(self, data: bytes) -> None:
         self._unset_keepalive_if_required()
 
@@ -204,12 +221,9 @@ def handle_events(self) -> None:
                     "headers": self.headers,
                 }
 
-                for name, value in self.headers:
-                    if name == b"connection":
-                        tokens = [token.lower().strip() for token in value.split(b",")]
-                        if b"upgrade" in tokens:
-                            self.handle_upgrade(event)
-                            return
+                if self._should_upgrade(self.headers, event):
+                    self.handle_upgrade(event)
+                    return
 
                 # Handle 503 responses when 'limit_concurrency' is exceeded.
                 if self.limit_concurrency is not None and (

uvicorn/protocols/http/httptools_impl.py

@@ -149,6 +149,21 @@ def _unset_keepalive_if_required(self) -> None:
             self.timeout_keep_alive_task.cancel()
             self.timeout_keep_alive_task = None
 
+    def _should_upgrade(self, headers: List[Tuple[bytes, bytes]]) -> bool:
+        connection = []
+        upgrade = None
+        for name, value in headers:
+            if name == b"connection":
+                connection = [token.lower().strip() for token in value.split(b",")]
+            if name == b"upgrade":
+                upgrade = value.lower().strip()
+
+        return (
+            b"upgrade" in connection
+            and upgrade == b"websocket"
+            and not self.config.ws_ignore_upgrade
+        )
+
     def data_received(self, data: bytes) -> None:
         self._unset_keepalive_if_required()
 
@@ -160,7 +175,8 @@ def data_received(self, data: bytes) -> None:
             self.send_400_response(msg)
             return
         except httptools.HttpParserUpgrade:
-            self.handle_upgrade()
+            if self._should_upgrade(self.headers):
+                self.handle_upgrade()
 
     def handle_upgrade(self) -> None:
         upgrade_value = None
@@ -244,7 +260,7 @@ def on_headers_complete(self) -> None:
         self.scope["method"] = method.decode("ascii")
         if http_version != "1.1":
             self.scope["http_version"] = http_version
-        if self.parser.should_upgrade():
+        if self.parser.should_upgrade() and self._should_upgrade(self.headers):
             return
         parsed_url = httptools.parse_url(self.url)
         raw_path = parsed_url.path
@@ -291,15 +307,19 @@ def on_headers_complete(self) -> None:
             self.pipeline.appendleft((self.cycle, app))
 
     def on_body(self, body: bytes) -> None:
-        if self.parser.should_upgrade() or self.cycle.response_complete:
+        if (
+            self.parser.should_upgrade() and self._should_upgrade(self.headers)
+        ) or self.cycle.response_complete:
             return
         self.cycle.body += body
         if len(self.cycle.body) > HIGH_WATER_LIMIT:
             self.flow.pause_reading()
         self.cycle.message_event.set()
 
     def on_message_complete(self) -> None:
-        if self.parser.should_upgrade() or self.cycle.response_complete:
+        if (
+            self.parser.should_upgrade() and self._should_upgrade(self.headers)
+        ) or self.cycle.response_complete:
             return
         self.cycle.more_body = False
         self.cycle.message_event.set()