3 ms·
Parsers for HTTP/1.x are kind of a solved problem though, even in unsafe languages. The danger is always when someone thinks they can do it themselves as a 30
by nly 1y ago
Parsers for HTTP/1.x are kind of a solved problem though, even in unsafe languages.
The danger is always when someone thinks they can do it themselves as a 30 minute side quest.
- 01HNNWZ0MV43FF 1y agoThe author of https://http1mustdie.com/ https://http1mustdie.com/ says that the desync issues caused by pipelined HTTP requests combined with reverse proxies are so bad that we should stop using HTTP/1.1 for anything Even the popular and battle-tested implementations disagree on how to interpret requests, which causes vulnerabilities when forwarding them to origin servers
- nly 1y agoYeah. That research is pretty damning The CDN and proxy operators are in a tight spot here also, since disabling connection reuse for upstream requests will likely crush performance.