commit cd8f8026bb3bf78889e406e3253aad047e49b2e4
author Filippo Valsorda <filippo@golang.org> Mon Jun 08 21:19:01 2020 -0400
committer Filippo Valsorda <filippo@golang.org> Tue Jun 09 16:23:52 2020 +0000
tree 2f61775cf6f1adbfff1f0b1dd4a6f7642b50f795
parent e5e386938f4ace00c00de86ead47ed5c02961e5b

doc/go1.15: add remaining release notes for net/http and net/http/httputil

Updates #37419

Change-Id: I3e37b650475aad4430aacd4655c02e5081ca6f5e
Reviewed-on: https://go-review.googlesource.com/c/go/+/237019
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>

doc/go1.15.html

diff --git a/doc/go1.15.html b/doc/go1.15.html
index fc8ee2d..50f4fea 100644
--- a/doc/go1.15.html
+++ b/doc/go1.15.html
@@ -639,8 +639,10 @@
 
 <dl id="net/http"><dt><a href="/pkg/net/http/">net/http</a></dt>
   <dd>
-    <p><!-- CL 231418 -->
-      TODO: <a href="https://golang.org/cl/231418">https://golang.org/cl/231418</a>: only support &#34;chunked&#34; in inbound Transfer-Encoding headers
+    <p><!-- CL 231418, CL 231419 -->
+      Parsing is now stricter as a hardening measure against request smuggling attacks:
+      non-ASCII white space is no longer trimmed like SP and HTAB, and support for the
+      "<code>identity</code>" <code>Transfer-Encoding</code> was dropped.
     </p>
   </dd>
 </dl><!-- net/http -->
@@ -655,7 +657,9 @@
     </p>
 
     <p><!-- CL 224897 -->
-      TODO: <a href="https://golang.org/cl/224897">https://golang.org/cl/224897</a>: make Switching Protocol requests (e.g. Websockets) cancelable
+      When a Switching Protocol (like WebSocket) request handled by
+      <a href="/pkg/net/http/httputil/#ReverseProxy"><code>ReverseProxy</code></a>
+      is canceled, the backend connection is now correctly closed.
     </p>
   </dd>
 </dl>