3 ms·
Ok, but it's not the same problem, which was the question asked.
by stonogo 3y ago
Ok, but it's not the same problem, which was the question asked.
- vlovich123 3y agoI’m still missing something. Can’t you close a Quic stream and open another one within the same UDP packet?
- jsnell 3y agoYou can do it a few times, but you can't do it 500 times. For HTTP/3, the highest permitted stream ID is an explicit state variable communicated by the server to the client, eventually forcing a round-trip. That's different from HTTP/2 where the client is entitled to assume that new "stream id window space" (for the lack of a better term) opens up immediately after a stream is closed. (I'm fudging things a bit. You can probably build attacks that look kind of similar, but we don't think you you could build anything that is actually scalable. But we could be wrong about that! Hence the recommendation to apply similar mitigations to HTTP/3 as well, even if it isn't immediately vulnerable.)
- vlovich123 3y agoThanks for the explanation. Makes sense.