I don't know if this is a bug or not but... yes you were right...

All the work should be done in the ngx_http_read_client_request_body handler, as it does duplicate the r connection to another address

What confused me is the fact that this is only done in http2 connections...

I really don't know why but all the changes i do in the read_client_request handler reflect to the main ngx_http_request_t struct. I thought the code was cleaner by having the body read in a function and parse the data from it in another function.

Well this doesn't work with http2 because all the changes done in read_client_request handler get lost and doesn't apply to the main struct...

Think this is a bug as the behavior should be similar and not change across http versions...

Sorry for the bad explanation... Also i think this should be noted in the wiki.