--- a/mercurial/httppeer.py	Sat Apr 13 02:01:26 2019 +0200
+++ b/mercurial/httppeer.py	Fri Apr 05 01:17:15 2019 +0200
@@ -108,7 +108,14 @@
 
 
 def makev1commandrequest(
-    ui, requestbuilder, caps, capablefn, repobaseurl, cmd, args
+    ui,
+    requestbuilder,
+    caps,
+    capablefn,
+    repobaseurl,
+    cmd,
+    args,
+    remotehidden=False,
 ):
     """Make an HTTP request to run a command for a version 1 client.
 
@@ -127,6 +134,8 @@
 
     ui.debug(b"sending %s command\n" % cmd)
     q = [(b'cmd', cmd)]
+    if remotehidden:
+        q.append(('access-hidden', '1'))
     headersize = 0
     # Important: don't use self.capable() here or else you end up
     # with infinite recursion when trying to look up capabilities
@@ -385,18 +394,12 @@
         self, ui, path, url, opener, requestbuilder, caps, remotehidden=False
     ):
         super().__init__(ui, path=path, remotehidden=remotehidden)
-        if remotehidden:
-            msg = _(
-                b"ignoring `--remote-hidden` request\n"
-                b"(access to hidden changeset for http peers not "
-                b"supported yet)\n"
-            )
-            ui.warn(msg)
         self._url = url
         self._caps = caps
         self.limitedarguments = caps is not None and b'httppostargs' not in caps
         self._urlopener = opener
         self._requestbuilder = requestbuilder
+        self._remotehidden = remotehidden
 
     def __del__(self):
         for h in self._urlopener.handlers:
@@ -451,6 +454,7 @@
             self._url,
             cmd,
             args,
+            self._remotehidden,
         )
 
         resp = sendrequest(self.ui, self._urlopener, req)

--- a/tests/test-remote-hidden.t	Sat Apr 13 02:01:26 2019 +0200
+++ b/tests/test-remote-hidden.t	Fri Apr 05 01:17:15 2019 +0200
@@ -211,6 +211,100 @@
   revision:    2
   revision:    0
 
+Test --remote-hidden for http peer
+----------------------------------
+
+  $ hg clone --pull http://localhost:$HGPORT client-http
+  requesting all changes
+  adding changesets
+  adding manifests
+  adding file changes
+  added 2 changesets with 2 changes to 1 files
+  2 new obsolescence markers
+  new changesets 5f354f46e585:c33affeb3f6b (1 drafts)
+  updating to branch default
+  1 files updated, 0 files merged, 0 files removed, 0 files unresolved
+  $ hg -R client-http log -G --hidden -v
+  @  1:c33affeb3f6b c_Amend_New [draft]
+  |
+  o  0:5f354f46e585 c_Public [public]
+  
+
+pulling an hidden changeset should fail:
+
+  $ hg -R client-http pull -r be215fbb8c50
+  pulling from http://localhost:$HGPORT/
+  abort: filtered revision 'be215fbb8c50' (not in 'served' subset)
+  [255]
+
+pulling an hidden changeset with --remote-hidden should succeed:
+
+  $ hg -R client-http pull --remote-hidden -r be215fbb8c50
+  pulling from http://localhost:$HGPORT/
+  searching for changes
+  adding changesets
+  adding manifests
+  adding file changes
+  added 1 changesets with 1 changes to 1 files (+1 heads)
+  (1 other changesets obsolete on arrival)
+  (run 'hg heads' to see heads)
+  $ hg -R client-http log -G --hidden -v
+  x  2:be215fbb8c50 c_Amend_Old [draft]
+  |
+  | @  1:c33affeb3f6b c_Amend_New [draft]
+  |/
+  o  0:5f354f46e585 c_Public [public]
+  
+
+Pulling a secret changeset is still forbidden:
+
+secret visible:
+
+  $ hg -R client-http pull --remote-hidden -r 8d28cbe335f3
+  pulling from http://localhost:$HGPORT/
+  abort: filtered revision '8d28cbe335f3' (not in 'served.hidden' subset)
+  [255]
+
+secret hidden:
+
+  $ hg -R client-http pull --remote-hidden -r 1c6afd79eb66
+  pulling from http://localhost:$HGPORT/
+  abort: filtered revision '1c6afd79eb66' (not in 'served.hidden' subset)
+  [255]
+
+Same check on a server that do not allow hidden access:
+```````````````````````````````````````````````````````
+
+  $ hg clone --pull http://localhost:$HGPORT1 client-http2
+  requesting all changes
+  adding changesets
+  adding manifests
+  adding file changes
+  added 2 changesets with 2 changes to 1 files
+  2 new obsolescence markers
+  new changesets 5f354f46e585:c33affeb3f6b (1 drafts)
+  updating to branch default
+  1 files updated, 0 files merged, 0 files removed, 0 files unresolved
+  $ hg -R client-http2 log -G --hidden -v
+  @  1:c33affeb3f6b c_Amend_New [draft]
+  |
+  o  0:5f354f46e585 c_Public [public]
+  
+
+pulling an hidden changeset should fail:
+
+  $ hg -R client-http2 pull -r be215fbb8c50
+  pulling from http://localhost:$HGPORT1/
+  abort: filtered revision 'be215fbb8c50' (not in 'served' subset)
+  [255]
+
+pulling an hidden changeset with --remote-hidden should fail too:
+
+  $ hg -R client-http2 pull --remote-hidden -r be215fbb8c50
+  pulling from http://localhost:$HGPORT1/
+  abort: filtered revision 'be215fbb8c50' (not in 'served' subset)
+  [255]
+
 =============
 Final cleanup
 =============