仅在某些客户端中在Nginx中启用http2

Question

I have two set of users using okhttp/2.7.0 and okhttp/3.12.0 . I want to enable http2 in nginx only for those users who are using okhttp/3.12.0 . The client ensures to send their identifier. Is there a way to use this information and enable http2 only for those users.

Note: Multiple ports is not an option for me.

My nginx and OS version

nginx version: nginx/1.14.2                                                                                                                                                                                                                  
built by gcc 4.8.4 (Ubuntu 4.8.4-2ubuntu1~14.04.4)                                                                                                                                                                                           
built with OpenSSL 1.0.2h  3 May 2016                                                                                                                                                                                                        
TLS SNI support enabled  

My nginx conf goes like this

server {
    listen 443 ssl http2;
    ...

Answer 1

This is not really possible. The client is only sent as part of a HTTP message, which is only sent after the version of HTTP to use is decided, obviously. The initially message to create the connection, and set up the SSL/TLS parameters won't have the client (which is usually where the HTTP version is decided using the ALPN extension to TLS).

There are however other ways this might be possible, including:

• Depending on the capabilities of the client. I'm not familiar with okhttp but from a quick Google it seems ALPN support was only added in v3, so you could disable the older NPN on your server and then, if that is correct, then in theory the older client will not be able to negotiate HTTP/2 so will fallback to HTTP/1.1. Unfortunately there appears to be no Nginx config option for that so you'd need to build a special version of OpenSSL without NPN support and then compile Nginx against that. Probably more hassle than it's worth.

• Use Apache instead of Nginx as it never supported NPN

• Using Multiple IPs and somehow directing each version to a separate IP. Though I suspect as you cannot use separate ports you probably cannot do this either.

All in all it's a bit of hack to be honest and so is not something that I would suggest you pursue. What you have not explained however is why you want to use HTTP/2 for one set of clients but not the other. Maybe there's a better way to achieve what you want if you explain that.