Problem disabling HTTP/2 for connections to backend servers

Traefik Traefik v3 (latest)
1

Hello,

I use Træfik v3.4.1 via Docker Compose. Due to an HTTP error "421 Misdirected Request" I want to disable HTTP/2 for the connections from Traefik to my backend servers.

Therefore I configured

http:
  serversTransports:
    degradedConnection:
      insecureSkipVerify: true
      disableHTTP2: true

and

http:
  routers:
    my-config-realmsmaster:
      rule: Host(`portal.mydomain.tld`) && ! (PathPrefix(`/univention/login`) || PathPrefix(`/univention/management`))
      tls:
        certresolver: letsencrypt
      middlewares:
       - customheaders
      service: my-config

  middlewares:
    customheaders:
      headers:
        customRequestHeaders:
          X-Forwarded-Proto: https

  services:
    my-config:
      loadBalancer:
        servers:
        - url: https://internal.mydomain.tld:443/
        serversTransport: degradedConnection@file

That the configuration works in general I know because the backend connection works in general but wouldn't work without insecureSkipVerify (I tried).

When I have a look in the access.log which I activated beforehand I see the following:

{"ClientAddr":"61.8.xx.yy:31423","ClientHost":"61.8.xx.yy","ClientPort":"31423","ClientUsername":"-","DownstreamContentSize":407,"DownstreamStatus":421,"Duration":3971839,"OriginContentSize":407,"OriginDuration":3824363,"OriginStatus":421,"Overhead":147476,"RequestAddr":"portal.mydomain.tld","RequestContentSize":0,"RequestCount":15,"RequestHost":"portal.mydomain.tld","RequestMethod":"GET","RequestPath":"/realms/ucs/protocol/saml?<redacted>","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"my-config-realmsmaster@file","ServiceAddr":"internal.mydomain.tld:443","ServiceName":"my-config@file","ServiceURL":"https://internal.mydomain.tld:443/","StartLocal":"2025-06-26T17:44:52.602047683Z","StartUTC":"2025-06-26T17:44:52.602047683Z","TLSCipher":"TLS_CHACHA20_POLY1305_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2025-06-26T17:44:52Z"}

What I mean is the "RequestProtocol":"HTTP/2.0" which tells me that the disableHTTP2 didn't work, correct? But why is this like this?

Thanks in advance!

2

I think the RequestProtocol is the protocol of the external request received by Traefik. It seems there is no ServiceProtocol logged, but there is a ServiceAddr, ServiceName and ServiceURL. You could open a feature request with the devs on Traefik Github :slight_smile: