HTTP/1.0 Protocol Downgrade (PCI DSS) - Is it possible to reject HTTP/1.0 requests in Traefik?

Traefik
,
1

I'm trying to satisfy a PCI DSS ASV scan that fails with the following finding:

HTTP/1.0 Protocol Downgrade Detected

The recommendation from the PCI vendor is that the server should reject HTTP/1.0 requests and only allow HTTP/1.1 or newer.

Environment

  • Traefik v3.6 (upgraded from v3.1)
  • Running as the default proxy in Coolify
  • Next.js + Payload CMS application
  • TLS 1.3
  • HTTP/2 and HTTP/3 enabled

What I've verified

The server still accepts HTTP/1.0 requests:



curl -I --http1.0 https://grandrapidsallergy.com

Response:



HTTP/1.0 200 OK

HTTP/1.1 works as expected:



curl -I --http1.1 https://grandrapidsallergy.com

Response:



HTTP/1.1 200 OK

I've also verified that:

  • TLS 1.3 is being negotiated.
  • The issue persists after upgrading Traefik from v3.1 to v3.6.
  • I cannot find any CLI flag, static configuration, or entrypoint option to disable or reject HTTP/1.0.

Question

Is there any supported way in Traefik to:

  • Reject HTTP/1.0 requests entirely,
  • Return 505 HTTP Version Not Supported for HTTP/1.0,
  • Or otherwise prevent HTTP/1.0 from being accepted?

Or is supporting HTTP/1.0 currently a limitation of Traefik (or Go's net/http server)?

If this isn't possible, what is the recommended approach for meeting PCI DSS requirements when an ASV scan requires HTTP/1.0 to be rejected?

Thanks!

2

I'm seeing the same behavior with Traefik v3.6: curl --http1.0 still receives a successful response even when HTTP/2 and HTTP/3 are enabled. A supported way to return 505 or enforce the PCI requirement at the Traefik or Go server layer would be very helpful.