Re: New Version Notification for draft-nottingham-http2-encryption-02.txt

On Thu, Dec 12, 2013 at 3:56 PM, Mark Nottingham <> wrote:

> Based on this discussion, it sounds like I can go ahead and remove h2r and
> refine the semantics of h2t to include the HTTP URI use case (i.e., no auth
> if on the same host, strong auth if on a different host).

> Make sense?

I am not sure it makes sense, but also I am not sure I understand the
proposal. It seems like you are proposing to move the defense against MitM
from TLS to the HTTP layer, where the HTTP layer will try to prevent MitM
by checking the scheme on each individual request. However, in HTTP/2,
isn't it the case that there are other types of things that get sent and
received on the connection besides requests and responses? Option
negotiation and whatnot? How would the server know that *those* things,
which don't have URIs associated with them, are authenticated or not?

Again, I think I might be misunderstanding the proposal, and more clarity
would be helpful.


Received on Saturday, 14 December 2013 20:57:40 UTC