Repository: traefik/traefik (language: go)

Issue:
websocket errors after upgrading traefik from 3.2.3 to 3.2.4 or 3.3.0
### Welcome!

- [x] Yes, I've searched similar issues on [GitHub](https://github.com/traefik/traefik/issues) and didn't find any.
- [x] Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any.

### What did you do?

I am running MinIO behind traefik using docker compose, and after upgrading today to 3.2.4 or 3.3.0 MinIO fails with websocket errors when trying to list/browse objects in a bucket through the console web interface. Downgrading to 3.2.3 fixes it again with the following compose file listed below. What broke!?!

### What did you see instead?

websocket connection error in  browser developer console and nothing is listed....

### What version of Traefik are you using?

3.2.4

### What is your environment & configuration?
```

services:
  minio1:
    image: minio/minio:RELEASE.2024-12-18T13-15-44Z
    restart: unless-stopped
    volumes:
      - /opt/minio:/opt/minio
    expose:
      - "9000"
      - "9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ADMIN_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ADMIN_PASS}
      MINIO_VOLUMES: "/opt/minio"
      MINIO_PROMETHEUS_AUTH_TYPE: public
    command:
      - server
      - --address
      - ":9000"
      - --console-address
      - ":9001"
    healthcheck:
      test: [ "CMD", "mc", "ready", "local" ]
      interval: 5s
      timeout: 5s
      retries: 5
    labels:
      - "traefik.enable=true"
      ## minio-console
      - "traefik.http.routers.minio-console.rule=Host(`minio-console-osl.example.com`)"
      - "traefik.http.routers.minio-console.entrypoints=web,websecure"
      - "traefik.http.routers.minio-console.tls=true"
      - "traefik.http.routers.minio-console.service=minio-console"
      - "traefik.http.services.minio-console.loadbalancer.server.port=9001"
      ## minio-api
      - "traefik.http.routers.minio-api.rule=HostRegexp(`[host:.+]`)"
      - "traefik.http.routers.minio-api.entrypoints=web,websecure"
      - "traefik.http.routers.minio-api.tls=true"
      - "traefik.http.routers.minio-api.service=minio-api"
      - "traefik.http.services.minio-api.loadbalancer.server.port=9000"

  traefik:
    # image: "traefik:v3.2.3"
    image: "traefik:v3.2.4"
    container_name: "traefik"
    restart: unless-stopped
    command:
      - "--log.level=DEBUG"
      - "--api"
      - "--api.insecure=true"
      - "--api.dashboard=true"
      - "--accesslog=true"
      - "--accesslog.format=json"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.traefik.address=:8080"
      - "--providers.file.directory=/traefik-conf/"
      - "--providers.file.watch=true"
      - "--metrics.prometheus=true"
      - "--metrics.prometheus.addEntryPointsLabels=true"
      - "--metrics.prometheus.addServicesLabels=true"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.web.http.redirections.entrypoint.permanent=true"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - $PWD/traefik-conf/dynamic-conf.toml:/traefik-conf/dynamic-conf.toml
      - $PWD/ssl:/ssl
      - /var/log/:/var/log/
    depends_on:
      - minio1

```

### If applicable, please paste the log output in DEBUG level

_No response_


Discussion / hints:
Same goes for HomeAssistant, could not access it through my Traefik URL but local IP worked fine. 
After downgrading to 3.2.3 it works fine again. 


```
http:
  routers:
    home-assistant:
      entryPoints:
        - https
      service: home-assistant-service
      rule: "Host(`home.domain.nl`)"

  services:
    home-assistant-service:
      loadBalancer:
        servers:
          - url: http://192.168.1.9:8123
        passHostHeader: true

```
Same here. Any Websockets traffic gives the error - 2025-01-06T20:56:40Z DBG github.com/traefik/traefik/v3/pkg/proxy/httputil/proxy.go:117 > 500 Internal Server Error error="net/http: invalid header field name \":protocol\""
Confirmed. 3.2.4 and 3.3.0 broke my homelab. Back to 3.2.3 waiting for the fix.
Not related to me, but perhaps others, 3.2.3 accepted a dynamic-conf file having HostRegexp rules using {} and not [], this broke in 3.2.4 and 3.3.0 also, example: 

```
[http.routers]
  [http.routers.traefik]
    rule = "HostRegexp(`{host:.+}`)"
    service = "api@internal"
    entrypoints = "traefik"
    middlewares = ["auth"]
  [http.routers.traefik.tls]
```

v.s

```
[http.routers]
  [http.routers.traefik]
    rule = "HostRegexp(`[host:.+]`)"
    service = "api@internal"
    entrypoints = "traefik"
    middlewares = ["auth"]
  [http.routers.traefik.tls]
```

And yes, I know that for 3.X you should use [], just saying the old syntax worked before. Should probably be mentioned in the changelogs!?!

Same error here, HomeAssistant got broken with 3.2.4, same error happens on 3.3.0. 3.2.3 works though. My config if that helps:

```yml
services:
  traefik:
    image: traefik:v3.2
    container_name: traefik
    command:
      - --ping=true
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.web-secure.address=:443
      - --entrypoints.web.http.redirections.entryPoint.to=web-secure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --experimental.plugins.rewrite-body.modulename=github.com/packruler/rewrite-body
      - --experimental.plugins.rewrite-body.version=v1.2.0
      - --experimental.plugins.rewriteHeaders.modulename=github.com/XciD/traefik-plugin-rewrite-headers
      - --experimental.plugins.rewriteHeaders.version=v0.0.3
      - --certificatesresolvers.myresolver.acme.dnschallenge=${DNS_CHALLENGE:-true}
      - --certificatesresolvers.myresolver.acme.dnschallenge.provider=${DNS_CHALLENGE_PROVIDER:-cloudflare}
      - --certificatesresolvers.myresolver.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53
      - --certificatesresolvers.myresolver.acme.caserver=${LETS_ENCRYPT_CA_SERVER:-https://acme-v02.api.letsencrypt.org/directory}
      - --certificatesresolvers.myresolver.acme.email=${LETS_ENCRYPT_EMAIL}
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
  homeassistant:
    image: ghcr.io/home-assistant/home-assistant:stable
    container_name: homeassistant
    network_mode: host
    labels:
      - traefik.enable=true
      - traefik.http.routers.homeassistant.rule=(Host(`${HOMEASSISTANT_HOSTNAME}`))
      - traefik.http.routers.homeassistant.tls=true
      - traefik.http.routers.homeassistant.tls.certresolver=myresolver
      - traefik.http.services.homeassistant.loadbalancer.server.port=8123
Also experienced this issue with both docker and file providers on 3.2.4. Rolled back to 3.2.3 and it works as it should.
+1 same issue w/ home-assistant
Same issue with immich and vaultwarden. Rollback to v3.2.3 confirmed working
I experienced this as well with Linux Server's Filezilla and Traefik v3.3.0.

`500 Internal Server Error error="net/http: invalid header field name \":protocol\""`
`499 Client Closed Request error="context canceled"`

```
2025-01-07T00:24:49Z DBG github.com/traefik/traefik/v3/pkg/server/service/loadbalancer/wrr/wrr.go:207 > Service selected by WRR: 63c648c9568b113d
...
2025-01-07T00:24:49Z DBG github.com/traefik/traefik/v3/pkg/proxy/httputil/proxy.go:117 > 500 Internal Server Error error="net/http: invalid header field name \":protocol\""
...
2025-01-07T00:24:49Z DBG github.com/traefik/traefik/v3/pkg/proxy/httputil/proxy.go:117 > 499 Client Closed Request error="context canceled"
...
```

Reverting to Traefik v3.2.3 for the time being.

I'm having the same issue after an upgrade to 2.11.17, rolling back to 2.11.16 fixes Home Assistant for me.
Adding, same issue. Downgrading for now.
Same issues, affecting Authentik and VSCode so far.  Downgrading as well.
Just spent hours debugging this because I was setting up a new service and couldn't get it to work (so thought it was an issue with that service). Downgrading to 3.2.3 fixed things for me!
Same issue here with HomeAssistant, rolling back to 3.2.3 is OK
3.3.0-rc2 was working correctly so must have been a regression introduced afterwards
Hey there,

Thanks for raising this issue.
We are analyzing it.

We'll make sure to keep you updated following up on this ticket as soon as we have more information to share.
> 3.3.0-rc2 was working correctly so must have been a regression introduced afterwards

I have pulled 3.3.0-rc2 and can confirm that it does not have the websocket issues I've experienced after upgrading to the 3.3.0 final version.
Hey there,

We have found the [root cause of the issue](https://github.com/golang/go/issues/71128#issuecomment-2574193636).
We're in the process of fixing it and releasing new versions.

In the meantime, you can use the latest version of Traefik if you set the following environment variable: `GODEBUG=http2xconnect=0`.

We'll update the issue with the PR that fixes it.

Fix patch:
diff --git a/cmd/traefik/traefik.go b/cmd/traefik/traefik.go
index 00683f9fdf..8eaf27c720 100644
--- a/cmd/traefik/traefik.go
+++ b/cmd/traefik/traefik.go
@@ -27,6 +27,7 @@ import (
 	"github.com/traefik/traefik/v3/cmd"
 	"github.com/traefik/traefik/v3/cmd/healthcheck"
 	cmdVersion "github.com/traefik/traefik/v3/cmd/version"
+	_ "github.com/traefik/traefik/v3/init"
 	tcli "github.com/traefik/traefik/v3/pkg/cli"
 	"github.com/traefik/traefik/v3/pkg/collector"
 	"github.com/traefik/traefik/v3/pkg/config/dynamic"
diff --git a/init/init.go b/init/init.go
new file mode 100644
index 0000000000..e54655d0f0
--- /dev/null
+++ b/init/init.go
@@ -0,0 +1,21 @@
+package init
+
+import (
+	"os"
+	"strings"
+)
+
+// This makes use of the GODEBUG flag `http2xconnect` to deactivate the connect setting for HTTP2 by default.
+// This type of upgrade is yet incompatible with `net/http` http1 reverse proxy.
+// Please see https://github.com/golang/go/issues/71128#issuecomment-2574193636.
+func init() {
+	goDebug := os.Getenv("GODEBUG")
+	if strings.Contains(goDebug, "http2xconnect") {
+		return
+	}
+
+	if len(goDebug) > 0 {
+		goDebug += ","
+	}
+	os.Setenv("GODEBUG", goDebug+"http2xconnect=0")
+}


Test patch: