Re: [whatwg/fetch] Streaming upload and HTTP protocol info leak (#1007)

They're per TLS connection status, and hence unencrypted HTTP is excluded.

> For this feature what we need is a site attempting to use HTTP/2 and it failing for a percentage of users, right?

This depends on `allowHTTP1ForStreamingUpload`.

I think we have four cases:

1. HTTP/2 (and above)
1. HTTP/1.1 that can be detected via ALPN
1. HTTP/1.1 with no ALPN information
1. HTTP/1.0 and below

With `allowHTTP1ForStreamingUpload: false`, we accept 1 and reject 2, 3 and 4.

With `allowHTTP1ForStreamingUpload: true`, we accept 1 and 2, but I'm not sure how to deal with 3 and 4. We can 

 - Make a try ("accept")
 - Get some hint information from related response (main resource or CORS preflight)
 - Give up ("reject")

If "ALPN not used" were much smaller than "HTTP/1.1 negotiated via ALPN" we didn't need to take much care of 3 and 4 but apparently that's not the case.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/1007#issuecomment-619832082