When Envoy terminates an HTTP CONNECT tunnel (see #1451) and sends a 200 response, it sends a Transfer-Encoding: chunked header. This is a violation of the RFC-7231 which states:

A server MUST NOT send any Transfer-Encoding or Content-Length header fields in a 2xx (Successful) response to CONNECT.

It looks as if the request path knows to strip the transfer-encoding header, since in Http1::RequestEncoderImpl::encodeHeaders, there is a branch that disables chunked encoding when the method is CONNECT:

  } else if (method->value() == Headers::get().MethodValues.Connect) {
    disableChunkEncoding();
    connect_request_ = true;
  }

There is no such check in Http1::ResponseEncoderImpl::encodeHeaders but if I unconditionally call disableChunkEncoding() in that method, the the transfer-encoding header goes away.

Edit: it looks like is_response_to_connect_request_ does the right thing, so this is probably an easy fix. I can submit a PR for this.