4 ms·
More than that, they relate to proxies. This sentence seems the crux to me: > If you're coding an HTTP/2 server, especially one that supports downgrading, enfo
by twic 5y ago
More than that, they relate to proxies. This sentence seems the crux to me:
> If you're coding an HTTP/2 server, especially one that supports downgrading, enforce the charset limitations present in HTTP/1 - reject requests that contain newlines in headers, colons in header names, spaces in the request method, etc.
- ObscureScience 5y agoWhat's wrong with it? It seems reasonable to protect yourself from header-injections allowed by a downgrade? Am I misunderstanding?
- twic 5y agoI don't think there's anything wrong with it, it's great advice!
- tyingq 5y agoI imagine it also relates to things that really "proxies", but not normally thought of as such. Like PHP-FPM, wsgi, etc. Those are also doing protocol and header translation, and are very ubiquitous.