net::ERR_HTTP2_SERVER_REFUSED_STREAM

[Maxim Dounin]

Hello!

On Tue, May 18, 2021 at 04:44:26PM +0530, Anoop Alias wrote:

> Browser consoles are showing error net::ERR_HTTP2_SERVER_REFUSED_STREAM and
> resources are not loading when enabling http2 ( see attached screenshot)
> 
> The error go away when http2 is disabled
> 
> #################################################
> [root at vps ~]# nginx -V
> nginx version: nginx/1.19.10
> built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC)
> built with OpenSSL 1.1.1k  25 Mar 2021
> TLS SNI support enabled
> configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx

[...]

> I had enabled debug logging, but it is hard to decipher for me the exact
> cause
> from the debug log
> 
> I am using the latest nginx so https://trac.nginx.org/nginx/ticket/2155 is
> ruled out as well
> 
> Debug log -- https://autom8n.com/nginx_debug.txt
> 
> Any help is much appreciated

>From the debug logs it looks like HTTP/2 connections are closed 
after the first request:

$ grep -a -E '(GOAWAY| accept:)' nginx_debug.txt
2021/05/17 22:27:30 [debug] 9555#9555: *1164 accept: 49.37.177.20:52350 fd:189
2021/05/17 22:27:31 [debug] 9555#9555: *1164 http2 send GOAWAY frame: last sid 1, error 0
2021/05/17 22:27:32 [debug] 9555#9555: *1176 accept: 49.37.177.20:52354 fd:172
2021/05/17 22:27:32 [debug] 9555#9555: *1177 accept: 49.37.177.20:52356 fd:178
2021/05/17 22:27:32 [debug] 9555#9555: *1176 http2 send GOAWAY frame: last sid 1, error 0
2021/05/17 22:27:32 [debug] 9555#9555: *1185 accept: 49.37.177.20:52362 fd:201
2021/05/17 22:27:32 [debug] 9555#9555: *1185 http2 send GOAWAY frame: last sid 1, error 0
2021/05/17 22:27:33 [debug] 9555#9555: *1191 accept: 49.37.177.20:52372 fd:204
2021/05/17 22:27:33 [debug] 9555#9555: *1191 http2 send GOAWAY frame: last sid 1, error 0
2021/05/17 22:27:41 [debug] 9555#9555: *1232 accept: 49.37.177.20:52382 fd:304
2021/05/17 22:27:42 [debug] 9555#9555: *1232 http2 send GOAWAY frame: last sid 1, error 0
2021/05/17 22:27:42 [debug] 9555#9555: *1238 accept: 49.37.177.20:52390 fd:305
2021/05/17 22:27:42 [debug] 9555#9555: *1238 http2 send GOAWAY frame: last sid 1, error 0
2021/05/17 22:27:43 [debug] 9555#9555: *1241 accept: 49.37.177.20:52404 fd:318
2021/05/17 22:27:43 [debug] 9555#9555: *1241 http2 send GOAWAY frame: last sid 1, error 0
2021/05/17 22:27:44 [debug] 9555#9555: *1250 accept: 49.37.177.20:52416 fd:305
2021/05/17 22:27:44 [debug] 9555#9555: *1250 http2 send GOAWAY frame: last sid 1, error 0
2021/05/17 22:27:55 [debug] 9555#9555: *1278 accept: 49.37.177.20:52510 fd:177
2021/05/17 22:27:55 [debug] 9555#9555: *1278 http2 send GOAWAY frame: last sid 1, error 0
2021/05/17 22:28:06 [debug] 9555#9555: *1304 accept: 49.37.177.20:52604 fd:187
2021/05/17 22:28:06 [debug] 9555#9555: *1304 http2 send GOAWAY frame: last sid 1, error 0
2021/05/17 22:28:06 [debug] 9555#9555: *1314 accept: 49.37.177.20:52602 fd:208
2021/05/17 22:28:09 [debug] 9555#9555: *1314 http2 send GOAWAY frame: last sid 0, error 0

Probably you have "keepalive_requests 1;" or "keepalive_timeout 0;" 
in the configuration, and this breaks things due to browsers 
not being able to handle GOAWAY, as explained in the ticket #2155.

Note that "fixed" status in the ticket #2155 does not mean that 
the issue is indeed completely resolved and cannot happen in 
practice: it can, and you certainly seeing the same issue.  The 
only thing we can do on nginx side is to adjust default settings 
to make it less likely to appear in practice.  The only complete 
solution would be to fix GOAWAY handling in browsers.

-- 
Maxim Dounin
http://mdounin.ru/