4 ms·

I think he's saying that clients could decide beforehand whether they want to go into HTTPS-only mode, for example. But this is something clients can actually

by rx4g 12y ago

I think he's saying that clients could decide beforehand whether they want to go into HTTPS-only mode, for example. But this is something clients can actually do today, without the need for a new protocol or any awareness on the server side. URL isn't HTTPS? Don't load it. I actually did a Firefox plugin that implements this, called http-nowhere.

matthewmacleod 12y ago
But this is something clients can actually do today, without the need for a new protocol or any awareness on the server side. URL isn't HTTPS? Don't load it. I actually did a Firefox plugin that implements this, called http-nowhere. Yes - and my understanding is that the browser developers are going to require all HTTP2 connections to be over TLS anyway.