Re: Attack research on HTTP/2 implementations

Hello Amos, others,

On 2021-08-07 18:30, Amos Jeffries wrote:

> The requirement to provide :scheme without a requirement to provide 
> :authority conflicts with the RFC3986 requirement that URLs containing 
> scheme MUST also contain an authority section.

Sorry, that's not the case. It's easy to understand when looking at the 
"hier-part" production at
https://datatracker.ietf.org/doc/html/rfc3986/#section-3. An authority 
component is only needed if the scheme is followed by two slashes. There 
are even schemes that allow an empty path
(https://datatracker.ietf.org/doc/html/rfc3986/#section-3.3). That was 
"pioneered" by "dav:", which very reluctantly lead to allowing empty 
paths is RFC 3986.

Regards,   Martin.

Received on Tuesday, 10 August 2021 04:29:41 UTC