Re: [whatwg/fetch] Streaming upload and HTTP protocol info leak (#1007)

Thank you.

The problematic part is, usually we know the HTTP version when the response arrives, in this case we need to fail the request before sending the request. Also we were talking about rejecting the request when the server likely to use HTTP/0.9 and HTTP/1.0: https://github.com/whatwg/fetch/issues/966#issuecomment-564470851.

Does the following make sense to you?

1. Same-origin case
   1. If the response to the main resource used HTTP/0.9 or HTTP/1.0:
      Fail the request, and record that HTTP version to the PerformanceResourceTiming entry of the failed request.
   1. If there is an existing HTTP/2 session, or the browser succeeded to create an HTTP/2 session:      Continue processing the request.
   1. if AllowHTTP1ForStreamingUpload is true:
     Continue processing the request.
   1. if AllowHTTP1ForStreamingUpload is false:
      Fail the request, and record HTTP/1.1 to the PerformanceResourceTiming entry of the failed request.
1. Cross-origin case
   1. If the response to the CORS preflight used HTTP/0.9 or HTTP/1.0:
      Fail the request, and record that HTTP version to the PerformanceResourceTiming entry of the failed request.
   1. If there is an existing HTTP/2 session, or the browser succeeded to create an HTTP/2 session:      Continue processing the request.
   1. if AllowHTTP1ForStreamingUpload is true:
     Continue processing the request.
   1. if AllowHTTP1ForStreamingUpload is false:
      Fail the request, and record HTTP/1.1 to the PerformanceResourceTiming entry of the failed request.




-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1007#issuecomment-613845321