3 ms·

Actually, a lot less. HTTP/2 frames are done as a binary protocol with fixed offsets, and instead of having three different transfer modes (chunked, keep-alive,

Actually, a lot less. HTTP/2 frames are done as a binary protocol with fixed offsets, and instead of having three different transfer modes (chunked, keep-alive, and one-shot), HTTP/2 has only its version of chunked. The best way to exploit an HTTP/2 server is to exploit the HTTP/1.1 server behind it [1]. [1]: https://portswigger.net/research/http2 https://portswigger.net/research/http2

josefx 5y ago
> The best way to exploit an HTTP/2 server is to exploit the HTTP/1.1 server behind it [1]. The exploit mentioned is the http/2 front end getting confused by the amount of responses it gets because it never checked how many http/1.1 messages it was forwarding, it just assumed that the http/1.1 headers where matching the http/2 headers. Now in defense of http/2 this was completely expected, called out in the spec. as requiring validation in case of tunneling and ignored by every implementation.