Skip to content

feat!: Replace HTTP/2 support with HTTPS - #1532

Open
matz3 wants to merge 3 commits into
mainfrom
feature/https
Open

feat!: Replace HTTP/2 support with HTTPS#1532
matz3 wants to merge 3 commits into
mainfrom
feature/https

Conversation

@matz3

@matz3 matz3 commented Aug 21, 2026

Copy link
Copy Markdown
Member

Remove the --h2 option of ui5 serve and the underlying HTTP/2 infrastructure, and add a new --https option in its place.

HTTP/2 was served via the spdy package, which is unmaintained and does not work with Node.js v24 and higher. The new --https option uses Node.js' built-in https server instead. The existing SSL certificate handling (auto-generation, --key/--cert) is reused.

JIRA: CPOUI5FOUNDATION-1310
JIRA: CPOUI5FOUNDATION-1311
See: #327
Closes: #1131

BREAKING CHANGE: The --h2 option of ui5 serve has been removed. Use --https to serve the project over HTTPS. The @ui5/server serve() option h2 and the returned h2 property have been renamed to https. If you need HTTP/2 for local development, put a reverse proxy (e.g. nginx) in front of the server to terminate it.

Comment thread packages/server/test/lib/server/https.js Fixed
@matz3
matz3 requested review from a team and KlattG August 21, 2026 10:05
@d3xter666

Copy link
Copy Markdown
Member

I found some cases that do not seem to be working now.
As a base I used the https://github.com/UI5/sample-app project.

Issue 1

Status in the main branch:
Working properly with spdy / --h2 flag.

Steps to reproduce:

  1. Clean the cache
  2. ui5 serve --https // You can add also the --verbose flag for visibility

Expected result:
Missing ui5 libs being downloaded and ui5 server starts successfully

Observed result:
The server crashes, because it cannot download the ui5 libs


Issue 2

Status in the main branch:
Almost the same, but from time to time I'm able to get the message Do you want to create new SSL certificates and install them locally? (yes) on the screen.

Steps to reproduce:

  1. Ensure you don't have installed certificate in ~/.ui5 folder
  2. ui5 build // to ensure the cache is full and won't reproduce Issue 1
  3. ui5 serve --https // You can add also the --verbose flag for visibility

Expected result:
Server runs successfully

Observed result:
The server "hangs" as the SSL message gets hidden, waiting for confirmation. This message is not visible: Do you want to create new SSL certificates and install them locally? (yes)

Workaround:
Use UI5_CLI_NO_INTERACTIVE flag.

UI5_CLI_NO_INTERACTIVE=1 ui5 serve --https --verbose

@matz3

matz3 commented Aug 21, 2026

Copy link
Copy Markdown
Member Author

Thank you for finding those issues. I only did a quick manual test and had framework libs and the certs already available.
Both seem unrelated to this PR, so I will create separate PRs.

Issue 1 will be fixed via #1535

matz3 and others added 3 commits August 21, 2026 15:30
Remove the `--h2` option of `ui5 serve` and the underlying HTTP/2
infrastructure, and add a new `--https` option in its place.

HTTP/2 was served via the `spdy` package, which is unmaintained and
does not work with Node.js v24 and higher. The new `--https` option
uses Node.js' built-in `https` server instead. The existing SSL
certificate handling (auto-generation, `--key`/`--cert`) is reused.

JIRA: CPOUI5FOUNDATION-1310
JIRA: CPOUI5FOUNDATION-1311
See: #327
Closes: #1131

BREAKING CHANGE: The `--h2` option of `ui5 serve` has been removed.
Use `--https` to serve the project over HTTPS. The `@ui5/server`
`serve()` option `h2` and the returned `h2` property have been renamed
to `https`. If you need HTTP/2 for local development, put a reverse
proxy (e.g. nginx) in front of the server to terminate it.
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
The HTTPS test disabled certificate validation via
NODE_TLS_REJECT_UNAUTHORIZED=0. Replace this with proper trust of the
server certificate via superagent's .ca() on the test agent, applied
once so all requests inherit it.

The previous fixture server.crt was a leaf certificate signed by a
separate, uncommitted CA, so it could not act as its own trust anchor.
Regenerate it as a genuine self-signed certificate for localhost.
@matz3

matz3 commented Aug 21, 2026

Copy link
Copy Markdown
Member Author

Issue 2 needs to be discussed on how to proceed. This is a regression caused by #1439, not related to this PR/feature.

@codeworrior

Copy link
Copy Markdown
Member

What are the options to proceed (or should we discuss it in our sync)?

@matz3

matz3 commented Aug 21, 2026

Copy link
Copy Markdown
Member Author

I would prefer removing the prompt from the standard "ui5 serve" command and instead having a dedicated CLI command to generate a local cert. Usually it is a one-time task and currently you can only generate it in combination with starting a server. So I believe splitting them up will not only resolve the interactive console issue, but also make it more flexible for users.
Starting a server without having a cert should then result in an error that suggests to run the dedicated command, or to provide the --key / --cert options.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants