{"record":{"id":"48b16275b5c2e173","repo":"denoland/deno","slug":"err-http2-connect-path","errorCode":"ERR_HTTP2_CONNECT_PATH","errorMessage":"The :path header is forbidden for CONNECT requests","messagePattern":"The :path header is forbidden for CONNECT requests","errorType":"validation","errorClass":"NodeError","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/http2/util.ts","lineNumber":696,"sourceCode":"        authority,\n      );\n    }\n    if (scheme === undefined) {\n      scheme = StringPrototypeSlice(session[kProtocol], 0, -1);\n      ArrayPrototypePush(additionalPsuedoHeaders, HTTP2_HEADER_SCHEME, scheme);\n    }\n    if (path === undefined) {\n      ArrayPrototypePush(additionalPsuedoHeaders, HTTP2_HEADER_PATH, \"/\");\n    }\n  } else {\n    if (authority === undefined) {\n      throw new ERR_HTTP2_CONNECT_AUTHORITY();\n    }\n    if (scheme !== undefined) {\n      throw new ERR_HTTP2_CONNECT_SCHEME();\n    }\n    if (path !== undefined) {\n      throw new ERR_HTTP2_CONNECT_PATH();\n    }\n  }\n\n  const rawHeaders = additionalPsuedoHeaders.length\n    ? ArrayPrototypeConcat(additionalPsuedoHeaders, headers)\n    : headers;\n\n  if (headers[kSensitiveHeaders] !== undefined) {\n    rawHeaders[kSensitiveHeaders] = headers[kSensitiveHeaders];\n  }\n\n  const headersList = buildNgHeaderString(\n    rawHeaders,\n    assertValidPseudoHeader,\n    session[kStrictSingleValueFields],\n  );\n\n  return {","sourceCodeStart":678,"sourceCodeEnd":714,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/http2/util.ts#L678-L714","documentation":"HTTP/2 CONNECT requests must not carry the ':path' pseudo-header (RFC 7540 section 8.3). When preparing a headers array for a CONNECT request, a defined :path throws ERR_HTTP2_CONNECT_PATH (util.ts:696) — CONNECT tunnels identify the target via :authority only.","triggerScenarios":"http2session.request() with ':method','CONNECT' and ':path' present in the headers array, e.g. [':method','CONNECT',':authority','h:443',':path','/tunnel']. Empty-string :path also counts as defined and still throws.","commonSituations":"Default request templates that always set :path:'/'; CONNECT proxies forwarding an origin-form target as a path; shared header builders that inject defaults for every request type.","solutions":["Remove ':path' entirely from the headers array for CONNECT requests (do not set it to '' — undefined is the only safe state).","Guard your header builder: if (method === 'CONNECT') push only :method and :authority.","Log the final headers array right before request() during development to catch injected defaults."],"exampleFix":"// before\nclient.request([':method', 'CONNECT', ':authority', 'h:443', ':path', '/']);\n\n// after\nclient.request([':method', 'CONNECT', ':authority', 'h:443']);","handlingStrategy":"validation","validationCode":"if (method === 'CONNECT') { headers = headers.filter((k, i) => i % 2 === 1 || k !== ':path'); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Templates defaulting ':path' to '/' must skip CONNECT","Log the final headers array before request() in dev builds"],"tags":["http2","connect","proxy","pseudo-header","node-compat"],"backgroundTag":"http2-connect-headers","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}