Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

http: update for http-core -14 moved sections #4742

Merged
merged 1 commit into from Jan 19, 2021
Merged

http: update for http-core -14 moved sections #4742

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions draft-ietf-quic-http.md
View file
Open in desktop
Expand Up @@ -664,7 +664,7 @@ as a number of bytes in the SETTINGS_MAX_FIELD_SECTION_SIZE parameter. An
implementation that has received this parameter SHOULD NOT send an HTTP message
header that exceeds the indicated size, as the peer will likely refuse to
process it. However, an HTTP message can traverse one or more intermediaries
before reaching the origin server; see Section 3.6 of {{!SEMANTICS}}. Because
before reaching the origin server; see Section 3.7 of {{!SEMANTICS}}. Because
this limit is applied separately by each implementation which processes the
message, messages below this limit are not guaranteed to be accepted.

Expand Down Expand Up @@ -1910,7 +1910,7 @@ resources consumed by CONNECT requests.
Compression can allow an attacker to recover secret data when it is compressed
in the same context as data under attacker control. HTTP/3 enables compression
of fields ({{header-formatting}}); the following concerns also apply to the use
of HTTP compressed content-codings; see Section 8.5.1 of {{!SEMANTICS}}.
of HTTP compressed content-codings; see Section 8.4.1 of {{!SEMANTICS}}.

There are demonstrable attacks on compression that exploit the characteristics
of the web (e.g., {{BREACH}}). The attacker induces multiple requests
Expand Down