[audit][standards] RFC 9218 Extensible Priorities not implemented (no PRIORITY_UPDATE frame, no Priority header); only deprecated RFC 7540 priority tree

Severity: medium · Category: missing-feature
Location: include/proxy/http2/HTTP2.h:176

What's wrong

The HTTP/2 frame-type constants stop at HTTP2_FRAME_TYPE_CONTINUATION = 9; PRIORITY_UPDATE (0x10) is not defined, SETTINGS_NO_RFC7540_PRIORITIES (0x9) is absent from the settings enum, and there is no parsing of the 'Priority' request header (urgency/incremental) anywhere in src (grep for PRIORITY_UPDATE/urgency/incremental returns only a TODO). ATS instead retains the RFC 7540 stream-dependency tree, which RFC 9113 deprecated and major browsers (Chrome, Firefox, Safari) have abandoned in favor of RFC 9218 for both h2 and h3. For HTTP/3, src/proxy/http3/Http3SettingsHandler.cc:81 carries only '// TODO: update settings for priority tree'. Result: client-signaled prioritization is ignored for modern clients, degrading page-load performance characteristics through the proxy.

Evidence

include/proxy/http2/HTTP2.h:176-178:
  HTTP2_FRAME_TYPE_GOAWAY        = 7,
  ...
  HTTP2_FRAME_TYPE_CONTINUATION  = 9,
src/proxy/http3/Http3SettingsHandler.cc:81:
    // TODO: update settings for priority tree

Suggested fix

Add PRIORITY_UPDATE frame handling and Priority header parsing (urgency 0-7, incremental flag), advertise SETTINGS_NO_RFC7540_PRIORITIES, and feed the values into the existing write-scheduling logic; this also requires an RFC 8941 structured-field item parser (see separate finding).

Filed from an automated multi-lens codebase audit. Full report: CODEBASE_AUDIT.md / audit-report.html on branch claude/codebase-audit-review-9nw7vz.

Start with the HTTP/2 frame constants in include/proxy/http2/HTTP2.h:176 and the HTTP/3 settings TODO in src/proxy/http3/Http3SettingsHandler.cc:81, then trace the existing write-scheduling logic and the reported PRIORITY_UPDATE/Priority-header search results. Done means handling RFC 9218 urgency and incremental signals for h2 and h3, advertising the new setting, and connecting them to scheduling; the separate RFC 8941 parser finding is also relevant.