Re: [whatwg/fetch] Streaming upload and HTTP protocol info leak (#1007)

>> If allowHTTP1ForStreamingUpload is true (default):

> Booleans should default to false, so consider flipping this to e.g. preventHTTP1ForStreamingUpload (default false)
 
Since I noticed upload streaming over HTTP/1.1 is flaky and unreliable,  `allowHTTP1ForStreamingUpload` 's default value should be `false`.

> I’m not sure why the distinction here on 1.0 / 0.9 responses, because it’s the request that’s sending the chunked encoding. Am I missing something basic?

We require HTTPS. This prevents any unauthorized intermediates (i.e. not explicitly authorized by the server or the user) from breaking. From https://github.com/whatwg/fetch/issues/966#issuecomment-573057154


> If it’s trying to avoid protocol leaks, they still happen in this model, because the client only sees the protocol to the intermediary and the server only sees the protocol from the intermediary, and they’re not necessarily the same.

I don't understand why protocol leaks with my chart given the asymmetric characteristic and yours block that. Could you explain more? @sleevi 


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1007#issuecomment-618842723