Description: VSV00018: enable HTTPS normalization by default, retaining opt-out
 .
 Backport to 7.7 without new counters, logging tags or method APIs.
 Retain stable CONNECT pipe policy; omit unrelated release notes.
Author: Nils Goroll <nils.goroll@uplex.de>
Origin: https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/commit/e8eccd46514e4b4f7ee5d970ee08a4e5a59586b8
Bug: https://vinyl-cache.org/security/VSV00018.html
Forwarded: not-needed
Last-Update: 2026-10-23

diff --git a/bin/varnishtest/tests/r01847.vtc b/bin/varnishtest/tests/r01847.vtc
index 6002b9e098..d82da1e0cc 100644
--- a/bin/varnishtest/tests/r01847.vtc
+++ b/bin/varnishtest/tests/r01847.vtc
@@ -26,10 +26,11 @@ client c1 {
 
 	txreq -url https://www.example.com/bar
 	rxresp
-	expect resp.status == 400
+	expect resp.http.rxhost == www.example.com
+	expect resp.http.rxurl == /bar
 } -run
 
-varnish v1 -cliok "param.set feature +https_scheme"
+varnish v1 -cliok "param.set feature -https_scheme"
 
 client c1 {
 	txreq -url http://www.example.com/bar
@@ -39,6 +40,5 @@ client c1 {
 
 	txreq -url https://www.example.com/bar
 	rxresp
-	expect resp.http.rxhost == www.example.com
-	expect resp.http.rxurl == /bar
+	expect resp.status == 400
 } -run
diff --git a/include/tbl/params.h b/include/tbl/params.h
index c94f771d59..bdb34e085b 100644
--- a/include/tbl/params.h
+++ b/include/tbl/params.h
@@ -1987,6 +1987,7 @@ PARAM_BITS(
 	/* fld */	feature_bits,
 	/* def */
 	"none,"
+	"+https_scheme,"
 	"+validate_headers,"
 	"+vcl_req_reset",
 	/* descr */
