Re: HTTPS 2.0 without TLS extension?

On Jul 22, 2013, at 10:24 PM, Ilari Liusvaara <ilari.liusvaara@elisanet.fi> wrote:

> On Mon, Jul 22, 2013 at 11:47:48AM -0500, Zhong Yu wrote:
>> Suppose a TLS connection is established without ALPN. Then an HTTP/1.1
>> request is sent over with Upgrade: HTTP/2.0. How should the server
>> respond?
> <snip>
> 
> There's also second abnormal case:
> TLS handshake without ALPN, but the application data starts with
> HTTP/2.0 magic…

I'm guessing that if either the TLS application data or the TCP connection in HTTP starts with the magic, it's HTTP/2.0.  Otherwise, why would we need the magic^H^H^H^HConnection Header?


>> Though "Upgrade" mechanism is less ideal than ALPN, since the server
>> must support it anyway on TCP connections, I don't see why we should
>> forbid it on TLS connections.
> 
> What about servers that are not willing to implement upgrade (it is fair
> amount of complexity)?

They'd have to stick to HTTP/1 for now, because no sane client start off with HTTP/2 for now.

> I.e. is there path to totally obsolete HTTP/1.1 in the far future?

Not by having servers or client that refuse to negotiate the version. It's also possible that by the time we can assume that we don't need HTTP/1 any more, we may have to contend with HTTP/3. 

Yoav

Received on Monday, 22 July 2013 19:45:17 UTC