iOS Safari session establishment
This host runs several WebTransport echo servers that differ by exactly one variable per exhibit. On iOS 27.0 beta, Safari refuses some and binds others, which isolates two findings.
Finding 1. iOS 27 enforces the conditional in draft-ietf-webtrans-http3 (draft-13/14): advertising WT_MAX_SESSIONS > 1 obliges the server to send the WT_INITIAL_MAX_* flow-control settings as well. A server that advertises the former without the latter is refused.
Finding 2. webtransport-go v0.12.0 on quic-go v0.61.0 is refused even when its SETTINGS and QUIC transport parameters are byte-identical to a v0.11.0/v0.60.0 server that binds. The difference is therefore in wire behaviour that neither party advertises.
Every server here presents a real Let's Encrypt certificate and uses no certificate pinning unless the case says otherwise. The host doubles as a general-purpose echo endpoint, and the tool below connects to any WebTransport URL, not just these.
Refusal signature. The client sees a WebTransportError with an empty message roughly 50 ms after construction. Server-side, the peer opens the extended-CONNECT stream, writes zero bytes, sends stop_sending(stream 0, 0x10C) and then closes the connection with 0x100.
filed as: [feedback / issue IDs to be added]
| case | expected (iOS 27β) | this device | ms | detail |
|---|
These four rows share one certificate and one echo handler. Comparing 1a against 1c alone would prove nothing, because both the settings and the library generation move between them. 1b is the bridge that splits those two variables apart.
Adding the flow-control settings on their own (1a → 1b) does not rescue v0.12.0. Changing only the library generation (1b → 1c, whose nine SETTINGS are byte-identical) flips the result. So finding 1 explains why 1a fails, and finding 2 explains why fixing that is not sufficient.
Each of these binds on iOS 27 beta. They rule out the explanations that would otherwise compete with findings 1 and 2 — certificate pinning, leaf shape, port number, the datagram maxAge setters, and quic-go itself.
A general WebTransport client for any endpoint. It defaults to the validated-era rung here, which is the known-good target.
Echo is budgeted (~1 MiB per session, 120 s) — plenty for any interop or dev test.
The original constructor sweep. Each link reloads this page with different query parameters and the connect button runs one attempt against the target shown.