3 ms·

HTTP versions less than 2 have serious unresolvable security issues related to http request/response smuggling and stream desynchronization. https://http1mustd

• hypeatei 10mo ago
  If you're using a reverse proxy, maybe. I don't think it's sufficient to kill a whole version of HTTP because of that.
  • 1vuio0pswjnm7 10mo ago
    There is an argument HTTP/2 was created by CDNs for CDNs (reverse proxies)
    • riedel 10mo ago
      For sure it was not created for things like the web of things. Around 2015 I had so much hope for it to be usable for embedded devices (like using compression with preshared ducts), but at least at the time the complexity of http/2 were overwhelming, with the actual improvements underwhelming.
• Sohcahtoa82 10mo ago
  I have an alternative... Rather than throwing HTTP/1.1 into the garbage can, why don't we throw Postel's Law [0] into the garbage where it belongs. Every method of performing request smuggling relies on making an HTTP request that violates spec. A request that sends both Content-Length and Transfer-Encoding is invalid. Sending two Content-Lengths is invalid. Two Transfer-Encoding headers is allowed -- They should be treated as a comma-separated lists -- so allow them and treat them as such, or canonicalize them as a single header if you're transforming it to something downstream. But for fuck's sake, there's literally no reason to accept requests that contain most of the methods that smuggling relies upon. Return a 400 Bad Request and move on. No legit client sends these invalid requests unless they have a bug, and it's not your job as a server to work around their bug. [0] Aka, The Robustness Principle, "Be conservative in what you send, liberal in what you accept."