3 ms·
> That occurred to me too. But HTTP/1.1 requires a Host: header. Yes, but that’s easily forgeable as long as the servers in between allow it. > It also brings
by jsjohnst 9y ago
> That occurred to me too. But HTTP/1.1 requires a Host: header.
Yes, but that’s easily forgeable as long as the servers in between allow it.
> It also brings a problem of key distribution.
Not really, you can still do chain of trust SSL validation on a payload in the body of HTTP as you could to encrypt the entire HTTP connection as in the case of HTTPS.
> Might cost a bit in SSL certs.
LetsEncrypt could help there.