Re: Attack research on HTTP/2 implementations

On Fri, Aug 06, 2021 at 03:04:33PM +0000, Mike Bishop wrote:
> :authority isn't included in the list because it's slightly different - it's
> not mandatory.

That's what I understood as well.

> So the others must occur exactly once (which is stated),
> while :authority must occur no more than once (which isn't).
> 
> But yes, that should be called out explicitly.

Definitely :-)

Willy

Received on Friday, 6 August 2021 16:36:33 UTC