http(h2): send the request again over HTTP/1.1 after HTTP_1_1_REQUIRED

packages/bun-types/globals.d.ts

@@ -2095,6 +2095,11 @@ interface BunFetchRequestInit extends RequestInit {
    * default (h2 is offered iff the flag is on). `"h2"`, `"h3"` and `"h1"`
    * are aliases.
    *
+   * Without this option, when the server refuses a request over HTTP/2 with
+   * `HTTP_1_1_REQUIRED` before it sends a response, Bun sends the request
+   * again over HTTP/1.1. A request whose body is a stream rejects. With
+   * `"http2"` the request stays on HTTP/2.
+   *
    * Requires `https`. Not part of the Fetch API specification.
    * @experimental
    */

src/http/h2_client/ClientSession.rs

@@ -101,6 +101,8 @@ pub struct ClientSession {
     pub(crate) preface_sent: bool,
     pub(crate) settings_received: bool,
     pub(crate) goaway_received: bool,
+    /// After GOAWAY(HTTP_1_1_REQUIRED), a request that waits for this connection goes to HTTP/1.1.
+    pub(crate) http1_required: bool,
     /// Set when the HPACK encoder's dynamic table has diverged from the
     /// server's view (writeRequest failed mid-encode). Existing siblings whose
     /// HEADERS already went out are unaffected, but no new stream may be
@@ -395,6 +397,7 @@ impl ClientSession {
             preface_sent: false,
             settings_received: false,
             goaway_received: false,
+            http1_required: false,
             encoder_poisoned: false,
             delivering: false,
             stream_progressed: false,
@@ -507,6 +510,10 @@ impl ClientSession {
             } else if self.has_headroom() {
                 self.attach(client);
             } else {
+                if self.http1_required {
+                    // A request that names h2 keeps its protocol.
+                    client.pin_to_http1();
+                }
                 client.h2_retry_after_coalesce();
             }
         }
@@ -1207,6 +1214,10 @@ impl ClientSession {
         if let Some(err) = stream.fatal_error {
             stream.client = None;
             client.h2 = None;
+            if stream.http1_required && stream.status_code == 0 && client.can_retry_over_http1() {
+                client.retry_over_http1();
+                return true;
+            }
             // Only transparently retry when the server refused the stream
             // before producing any of it (REFUSED_STREAM after HEADERS would
             // be a server bug, but retrying then re-streams a body prefix

src/http/h2_client/Stream.rs

@@ -56,6 +56,8 @@ pub struct Stream {
     /// or final status arrives.
     pub(crate) awaiting_continue: bool,
     pub(crate) fatal_error: Option<Error>,
+    /// Refused with HTTP_1_1_REQUIRED. A GOAWAY in the same read overwrites only `fatal_error`.
+    pub(crate) http1_required: bool,
     /// DATA bytes consumed since the last WINDOW_UPDATE for this stream.
     pub(crate) unacked_bytes: u32,
     /// Σ DATA payload bytes (post-padding) for §8.1.1 Content-Length check —
@@ -144,6 +146,7 @@ impl Stream {
             headers_end_stream: false,
             awaiting_continue: false,
             fatal_error: None,
+            http1_required: false,
             unacked_bytes: 0,
             data_bytes_received: 0,
             send_window,

src/http/h2_client/dispatch.rs

@@ -517,6 +517,7 @@ fn dispatch_frame(
                 }
                 _ => Some(crate::Error::HTTP2StreamReset),
             };
+            stream.http1_required |= code == wire::ErrorCode::HTTP_1_1_REQUIRED.0;
         }
         FT_GOAWAY => {
             if stream_id != 0 {
@@ -532,11 +533,14 @@ fn dispatch_frame(
                 wire::UInt31WithReserved::from_bytes(&payload[0..4]).uint31();
             let code: u32 = wire::u32_from_bytes(&payload[4..8]);
             let graceful = code == wire::ErrorCode::NO_ERROR.0;
+            let http1_required = code == wire::ErrorCode::HTTP_1_1_REQUIRED.0;
+            session.http1_required |= http1_required;
             let last_id = session.goaway_last_stream_id;
             for &s_ptr in session.streams.values() {
                 // SAFETY: stream pointer valid for session lifetime.
                 let s = stream_mut(s_ptr);
                 if s.id > last_id {
+                    s.http1_required |= http1_required;
                     s.fatal_error = Some(if graceful {
                         crate::Error::HTTP2RefusedStream
                     } else {
@@ -547,6 +551,10 @@ fn dispatch_frame(
                     // still complete successfully" — don't discard a
                     // response that already finished in this same read.
                     s.fatal_error = Some(crate::Error::HTTP2GoAway);
+                    // The peer may have processed the request: only an idempotent one goes again.
+                    if http1_required && s.client_ref().is_some_and(|c| c.method.is_idempotent()) {
+                        s.http1_required = true;
+                    }
                 }
             }
         }

src/http/lib.rs

@@ -2187,11 +2187,37 @@ impl<'a> HTTPClient<'a> {
         self.start_::<true>();
     }
 
+    /// A request that names its protocol keeps it, and only a `Bytes` body can be sent again.
+    pub(crate) fn can_retry_over_http1(&self) -> bool {
+        self.flags.forced_protocol.is_none()
+            && matches!(self.state.original_request_body, HTTPRequestBody::Bytes(_))
+    }
+
+    /// The peer refused the request with HTTP_1_1_REQUIRED before it sent a response.
+    pub(crate) fn retry_over_http1(&mut self) {
+        debug_assert!(self.h2.is_none());
+        debug_assert!(self.can_retry_over_http1());
+        self.pin_to_http1();
+        self.restart_from_top();
+    }
+
+    /// `can_offer_h2` and `can_try_h3_alt_svc` refuse the request from here on, redirects included.
+    pub(crate) fn pin_to_http1(&mut self) {
+        if self.flags.forced_protocol.is_none() {
+            self.flags.forced_protocol = Some(Protocol::Http1_1);
+        }
+    }
+
     pub(crate) fn retry_from_h2(&mut self) {
         debug_assert!(self.h2.is_none());
+        self.h2_retries += 1;
+        self.restart_from_top();
+    }
+
+    /// Start the request again through `start()`. The body can be sent again from its first byte.
+    fn restart_from_top(&mut self) {
         self.unregister_abort_tracker();
         self.flags.protocol = Protocol::Http1_1;
-        self.h2_retries += 1;
         let body = core::mem::replace(
             &mut self.state.original_request_body,
             HTTPRequestBody::Bytes(b""),
@@ -4120,7 +4146,7 @@ impl<'a> HTTPClient<'a> {
                     // PendingConnect that the rest of this loop would re-coalesce
                     // onto (which would serialise N cold fetches into N
                     // sequential handshakes). The origin already chose h1 once.
-                    waiter.flags.forced_protocol = Some(Protocol::Http1_1);
+                    waiter.pin_to_http1();
                     waiter.start_::<true>();
                 }
                 // The first waiter becomes the new leader; the rest re-coalesce

src/http_types/h2.rs

@@ -91,6 +91,7 @@ impl ErrorCode {
     pub const CANCEL: Self = Self(0x8);
     pub const COMPRESSION_ERROR: Self = Self(0x9);
     pub const ENHANCE_YOUR_CALM: Self = Self(0xb);
+    pub const HTTP_1_1_REQUIRED: Self = Self(0xd);
 }
 
 #[repr(transparent)]