Mixed http2/1.1 Authentication

Hello,

I am interested in understanding the interoperability of http
authentication in a mixed http2/1.1 deployment. The use case is http2
between client and load balancer (ssl offload), then http1.1 between load
balancer and server. Authentication occurs at the server, not the load
balancer. My understanding is that the authorization header is sent with
every request, but perhaps this is not the case if the client is performing
http2 header compression. It seems logical that it should be the
responsibility of the intermediary to cache and transmit the header with
each request. Does the standard stipulate the behavior of clients and
intermediaries to support authentication in a mixed design? Are there any
known limitations with such a design?

-Dennis

Received on Saturday, 12 March 2016 16:16:52 UTC