Verify :authority in HTTP/2 server push #3577

I did this

Nicolas Grekas correctly pointed out on the mailing list that libcurl doesn't verify the :athority header correct in the push headers, as described in RFC 7540:

The server MUST include a value in the :authority pseudo-header field for which the server is authoritative (see Section 10.1). A client MUST treat a PUSH_PROMISE for which the server is not authoritative as a stream error (Section 5.4.2) of type PROTOCOL_ERROR.

Right now, libcurl leaves that check for the application without it being documented or explained.

I expected the following

libcurl needs to check the header and reject pushes for non-validated authorities.

curl/libcurl version

curl master

operating system

All