@@ -446,8 +446,16 @@ plainHTTP TLSSettings{..} s bs0 = case onInsecure of
446446 }
447447 return (conn'', TCP)
448448 DenyInsecure lbs -> do
449− -- FIXME: what about HTTP/2?
450− -- http://tools.ietf.org/html/rfc2817#section-4.2
449+ -- Listening port 443 but TLS records do not arrive.
450+ -- We want to let the browser know that TLS is required.
451+ -- So, we use 426.
452+ -- http://tools.ietf.org/html/rfc2817#section-4.2
453+ -- https://tools.ietf.org/html/rfc7231#section-6.5.15
454+ -- FIXME: should we distinguish HTTP/1.1 and HTTP/2?
455+ -- In the case of HTTP/2, should we send
456+ -- GOAWAY + INADEQUATE_SECURITY?
457+ -- FIXME: Content-Length:
458+ -- FIXME: TLS/<version>
451459 sendAll s "HTTP/1.1 426 Upgrade Required\
452460 \r\nUpgrade: TLS/1.0, HTTP/1.1\
453461 \r\nConnection: Upgrade\