3 ms·

HTTP/1.1 is nice and simple compared to HTTP/2, which I think is severely overengineered. This "desync" attack seems completely pointless, it's not going to by

HTTP/1.1 is nice and simple compared to HTTP/2, which I think is severely overengineered. This "desync" attack seems completely pointless, it's not going to bypass TLS, and if you're not using an encrypted transport layer, HTTP is the least of your concerns...

gruntz 1y ago
Actually TLS does not protect you here. Problem is that reverse proxies do reuse backend connections and single backend connection may deliver requests from different users.
- AndyKelley 1y ago
  Sounds like not HTTP 1.1's problem.
  - jsnell 1y ago
    If a protocol is getting implemented wrong repeatedly and independently, what is the value in it being nominally "nice and simple"? You might not be understanding just how complex the H1.1 feature set really is, and how how much fragility comes from that complexity needing to be retrofit to a too-simple design later.