Re: Dealing with header injection through reverse proxies

[ taking tokbind off as it's not really for them ]

> On 17 Jul 2017, at 6:25 pm, Patrick McManus <mcmanus@ducksong.com> wrote:
> 
> b] if the proxy->server link is h2 then you can inject connection-specific information into the stream with an extension frame type (and the server can enforce this property). You don't need to negotiate it with SETTINGS (which is nice, because that's a round trip.) and these frames are hop to hop (proxies that don't understand a frame type MUST drop them).
> 
> Its not too hard to imagine a generalization of (b).. a CONNECTION-SPECIFIC-HEADERS or somesuch that has strict hop-to-hop semantics.

If I had a do-over, I'd still allow hop-by-hop headers in h2. HTTP/2 was designed to be a "drop-in" replacement for H1, and therefore there aren't any consistent (or often, existent) APIs for developers to use to affect things like extension frames or SETTINGS, and navigating the transition between H2 and H1 that's so common still in intermediaries.

Yes, it means touching the headers a bit more. *shrug*

Maybe we should have a SETTING_I_PROCESS_CONNECTION_HEADERS.


--
Mark Nottingham   https://www.mnot.net/

Received on Tuesday, 18 July 2017 12:25:07 UTC