HTTP/2-exclusive threats caused by implementation flaws and RFC imperfections

Re:HTTP/2-exclusive threats caused by implementation flaws a... by phicoh on Friday August 06, 2021 @04:18AM (#28084513)

Why does HTTP/2 force encryption? The HTTP/2 RFC (RFC 7540) also defines how to run HTTP/2 over plaintext.

Terminating HTTP/2 over TLS on a web frontend and then HTTP/2 over plaintext to the application servers sounds like a viable model.

[ Parent | on HN ]

Re:HTTP/2-exclusive threats caused by implementation flaws a... by londons_explore on Friday August 06, 2021 @05:15AM (#28084864)

In practice HTTP/2 forces encryption. For example Amazons ALB docs say "Considerations for the HTTP/2 protocol version: The only supported listener protocol is HTTPS." [1]

[1]: https://docs.aws.amazon.com/elasticloadbalancing/latest/appl...

[ Parent | on HN ]

Re:HTTP/2-exclusive threats caused by implementation flaws a... by pa9am on Friday August 06, 2021 @07:21AM (#28085624)

My Apache server is fine speaking HTTP/2 over port 80:

  curl -v --http2 --http2-prior-knowledge http://localhost
  * Connected to localhost (::1) port 80 (#0)
  * Using HTTP2, server supports multi-use
  * Connection state changed (HTTP/2 confirmed)
  * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
  * Using Stream ID: 1 (easy handle 0x559a7c6545c0)
  > GET / HTTP/2
  > Host: localhost
  > user-agent: curl/7.74.0
  > accept: */*
  > 
  * Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
  < HTTP/2 301 
  < date: Fri, 06 Aug 2021 11:16:05 GMT
  *snip*

Sadly none of the services that I reverse proxy through Apache support HTTP/2..

[ Parent | on HN ]

Re:HTTP/2-exclusive threats caused by implementation flaws a... by phicoh on Friday August 06, 2021 @06:24AM (#28085292)

It make sense that internet facing clients and servers only support HTTP/2 over TLS. But that is different for internal connections or debug tools.

[ Parent | on HN ]