Skip to main content

10. Security Considerations

10.1 Server Authority​

HTTP/2 relies on the HTTP/1.1 definition of authority for determining whether a server is authoritative for a given request.

10.2 Cross-Protocol Attacks​

HTTP/2 uses TLS with ALPN to protect against cross-protocol attacks on cleartext ports.

10.3 Intermediary Encapsulation Attacks​

HTTP/2 header field encoding allows the expression of names that are not valid field names in HTTP/1.1.

10.4 Cacheability of Pushed Responses​

Pushed responses do not have an explicit request from the client. A client cannot verify that a pushed response is an appropriate representation for the request.

10.5 Denial-of-Service Considerations​

10.5.1 Limits on Header Block Size​

Large or unbounded requests can be used to overload servers. Header block size can be limited using SETTINGS_MAX_HEADER_LIST_SIZE.

10.5.2 CONNECT Issues​

The CONNECT method can be used to create tunnels. Servers SHOULD monitor the amount of traffic and number of concurrent connections.

10.6 Use of Compression​

Compression can expose information about encrypted data. Implementations must be careful when using compression.

10.7 Use of Padding​

Padding can be used to obscure the actual size of frame content. However, padding is not a substitute for proper encryption.

10.8 Privacy Considerations​

Several characteristics of HTTP/2 provide an observer an opportunity to correlate actions of a single client or server over time.