Re:HPACK: the silent killer (feature) of HTTP/2
by niftich on Monday November 28, 2016 @01:48PM
(#13057481)
Yes, it allows re-use.
Access-Control-Allow-Origin is in the static table, and so is Strict-Transport-Security. The rest go into the dynamic table [1], which would be beneficial if they don't change.
Most security headers are hardcodeable, while C-S-P is designed to be a function of the selected resource representation, not some site-wide global. But it's often used in such a way.
Access-Control-Allow-Origin is in the static table, and so is Strict-Transport-Security. The rest go into the dynamic table [1], which would be beneficial if they don't change.
Most security headers are hardcodeable, while C-S-P is designed to be a function of the selected resource representation, not some site-wide global. But it's often used in such a way.
[1] https://tools.ietf.org/html/rfc7541#section-2.4