Skip to content

fix: Accept HTTP/1.1 responses in SocketPost to support proxies#616

Merged
rowan-m merged 3 commits intogoogle:mainfrom
SNO7E-G:fix/socketpost-http11-proxy
Mar 26, 2026
Merged

fix: Accept HTTP/1.1 responses in SocketPost to support proxies#616
rowan-m merged 3 commits intogoogle:mainfrom
SNO7E-G:fix/socketpost-http11-proxy

Conversation

@SNO7E-G
Copy link
Copy Markdown
Contributor

@SNO7E-G SNO7E-G commented Mar 26, 2026

Summary

Fixes false E_BAD_RESPONSE errors for users behind HTTP proxies or on hosting environments that rewrite outbound HTTP/1.0 traffic to HTTP/1.1.


The Problem

SocketPost::submit() sends an HTTP/1.0 POST request to the reCAPTCHA API. When the response arrives, it checks the status line with a strict strpos() comparison:

if (0 !== strpos($response, 'HTTP/1.0 200 OK')) {
    // returns E_BAD_RESPONSE
}

Some proxies, reverse proxies, and hosting environments transparently upgrade the connection and respond with HTTP/1.1 200 OK. This causes a false-positive failure — the reCAPTCHA verification was actually successful, but the library rejects the response.

The Fix

Replace the rigid strpos() check with a regex that securely accepts both HTTP versions:

if (1 !== preg_match('#^HTTP/1\.[01] 200 OK#', $response)) {
    // returns E_BAD_RESPONSE
}

This regex:

  • Anchors to the start of the response (^)
  • Only matches HTTP/1.0 or HTTP/1.1 (no other versions like HTTP/2)
  • Only matches status 200 OK (non-200 statuses are still correctly rejected)

Test Coverage

Added a new test testSubmitReturnsResponseWhenHttp11() that explicitly mocks an HTTP/1.1 200 OK response and asserts the body is returned correctly. The existing HTTP/1.0 tests remain unchanged and continue to pass.


Verification

> vendor/bin/phpunit
OK (60 tests, 158 assertions)

> vendor/bin/phpstan
[OK] No errors

> vendor/bin/php-cs-fixer check
All 22 files are correct.

@coveralls
Copy link
Copy Markdown

coveralls commented Mar 26, 2026

Coverage Status

coverage: 100.0%. remained the same
when pulling df61d9d on SNO7E-G:fix/socketpost-http11-proxy
into b6e64e7 on google:main.

@rowan-m
Copy link
Copy Markdown
Contributor

rowan-m commented Mar 26, 2026

Can you resolve the conflicts here as I had made some changes to the SocketPost class and test just before.

@SNO7E-G
Copy link
Copy Markdown
Contributor Author

SNO7E-G commented Mar 26, 2026

Can you resolve the conflicts here as I had made some changes to the SocketPost class and test just before.

Of course, no problem. I was waiting until you finished so I could pull all the changes along with the fixes.

#DONE

SNO7E-G added 3 commits March 26, 2026 21:52
Proxies and certain hosting environments may convert outbound HTTP/1.0
requests and respond with HTTP/1.1 200 OK. The previous strict check
(strpos for 'HTTP/1.0 200 OK') caused false E_BAD_RESPONSE errors for
these users.

Replace the strpos check with a regex that accepts both HTTP/1.0 and
HTTP/1.1 200 OK response headers. Add a dedicated test to verify
HTTP/1.1 responses are handled correctly.
@SNO7E-G SNO7E-G force-pushed the fix/socketpost-http11-proxy branch from 029ec01 to df61d9d Compare March 26, 2026 17:04
@rowan-m rowan-m merged commit caea152 into google:main Mar 26, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants