mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-14 02:39:06 +02:00
Viktor Liu
603e163d42
HTTP_1_1_REQUIRED is not a fault: it is the upstream describing its own configuration. IIS answers it for sites using Windows Authentication — connection-oriented auth that h2 multiplexing cannot carry — and for client-certificate sites, where the per-request certificate needs a TLS renegotiation h2 forbids. Browsers retry those on HTTP/1.1 silently, which is why such a site works in a browser and fails behind this proxy. Expiring that pin every 10 minutes would buy nothing but one failed request per interval, since nothing about the upstream has changed. So a pin the upstream asked for holds until the transport goes away with the proxy or the account's client, and the bounded TTL stays for the ambiguous protocol errors, where the failure may well clear on its own. A later ambiguous failure never weakens a permanent pin.