[Website] Support CURLFile uploads

[adamziel]

What it does

Fixes CURLFile uploads (and large POST requests in general) hanging indefinitely in the browser.

Rationale

PHP curl sends an Expect: 100-continue header for POST bodies larger than 1024 bytes. It pauses after the headers and waits for a 100 Continue response before transmitting the body. The TCP-over-fetch layer — which translates PHP's raw HTTP bytes into browser fetch() calls — didn't understand this protocol. It sat waiting for the body that curl was holding back, creating a deadlock that hung the page forever.

On top of that, the CORS proxy couldn't forward multipart uploads at all. PHP's built-in server consumes php://input when it parses multipart/form-data into $_POST and $_FILES, so the proxy was reading an empty stream.

Implementation

• TCP-over-fetch layer (tcp-over-fetch-websocket.ts)

  • Expect: 100-continue support. When PHP curl sends this header, the layer now detects it, strips it (the fetch() API doesn't support it), and sends back HTTP/1.1 100 Continue to unblock curl before issuing the actual fetch().

  • Body buffering for HTTP/1.1. Chrome does not support using a ReadableStream request body with HTTP/1.1 requests. If we just always set duplex: 'half', we'll get an ERR_ALPN_NEGOTIATION_FAILED error as Chrome will refuse to use duplex over HTTP/1.1 and will switch to HTTP/2. A HTTP/1.1-only server, however, will still reply with a HTTP/1.1 response, causing that ALPN error.

    We do not know upfront what kind of server we're talking to, so we make a guess. Most servers do not support HTTP >= 2 without TLS, so we can assume that anything starting with http:// requires buffering the body stream. This solves the ALPN negotiation problem on the local dev server.

    There will, inevitably, be some ancient HTTP/1.1+TLS servers on the internet that will fall into the duplex: half trap. This is not a big problem, though, since those requests will fail and be retried over the CORS proxy which runs alongside Playground and speaks either HTTP/1.1 in the local dev server or HTTP/2+ in production.

• Support for multipart/form-data requests in the CORS proxy (cors-proxy.php). It no longer relies on php://input that isn't populated for multipart requests, but reconstructs the body from $_POST and $_FILES using CURLFile.
• Only attempt to cache.put() GET/HEAD responses in offline-mode-cache.ts, otherwise cache.put() throws errors.

Testing instructions

Run the TCP-over-fetch unit tests:

npx nx test php-wasm-web --testFile=tcp-over-fetch-websocket.spec.ts

Tests cover body stream closing, Expect: 100-continue handling, and HTTP/1.1 body buffering.

[Copilot]

Pull request overview

Fixes PHP CURLFile uploads in the browser runtime by preventing fetch() from receiving the unsupported Expect: 100-continue header.

Changes:

• Make HTTP header parsing more robust (split on first delimiter rather than String.split).
• Strip the Expect header before issuing requests via fetch().
• Add multipart upload tests (including an Expect: 100-continue scenario) for web + node runtimes.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
packages/php-wasm/web/src/lib/tcp-over-fetch-websocket.ts	Updates request header parsing and removes Expect to avoid fetch() rejection.
packages/php-wasm/web/src/lib/tcp-over-fetch-websocket.spec.ts	Adds /upload test endpoint and multipart upload coverage (incl. Expect scenario).
packages/php-wasm/node/src/test/php-networking.spec.ts	Adds a node-side upload server and a PHP CURLFile upload regression test.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[adamziel]

Hmm this matters for the local dev server but not so much in production.