Skip to content

/ go

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/net/http2: validate connection headers more #14214

Closed
bradfitz opened this issue Feb 3, 2016 · 1 comment
Closed

x/net/http2: validate connection headers more #14214

bradfitz opened this issue Feb 3, 2016 · 1 comment
Assignees
@bradfitz
Labels
FrozenDueToAge
Milestone
Go1.7

Comments

@bradfitz
Copy link
Contributor

@bradfitz bradfitz commented Feb 3, 2016

Per https://httpwg.github.io/specs/rfc7540.html#rfc.section.8.1.2.2 and the problem described in curl/curl#633, we should make Go's http2 client & server as strict as the GFE when it comes to not sending and not accepting connection headers over http2.
@bradfitz bradfitz self-assigned this Feb 3, 2016
@bradfitz bradfitz added this to the Go1.7 milestone Feb 3, 2016
@admtnnr admtnnr mentioned this issue Feb 4, 2016
Closed
@bradfitz bradfitz mentioned this issue Apr 5, 2016
Closed
@gopherbot

This comment has been minimized.

Sign in to view
Copy link

@gopherbot gopherbot commented Apr 5, 2016

CL https://golang.org/cl/21534 mentions this issue.
@golang golang locked and limited conversation to collaborators Apr 6, 2017
c3mb0 pushed a commit to c3mb0/net that referenced this issue Apr 2, 2018
@bradfitz
http2: make Server reject connection-level headers with a 400 response
34aa9c8 
Fixes golang/go#14214

Change-Id: I474af4735e2135d787e948220a8fcdbba73a2b25
Reviewed-on: https://go-review.googlesource.com/21534
Reviewed-by: Andrew Gerrand <adg@golang.org>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@bradfitz bradfitz

Labels
FrozenDueToAge
Projects
None yet
Milestone
  Go1.7
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants
@bradfitz @gopherbot
You can’t perform that action at this time.