RFC 9931 - Security Considerations for Optimistic Protocol Transitions in HTTP/1.1

• Status: Proposed Standard
• Published: March 2026
• Stream: IETF
• Updates: RFC 9112, RFC 9298
• Errata: No Errata

Abstract

RFC 9931 describes security considerations for data sent optimistically before an HTTP/1.1 protocol transition is confirmed. It updates RFC 9112 and RFC 9298 with requirements intended to avoid request smuggling and related security issues.

Contents

• 1. Overview
• 2. Requirements Language
• 3. Background
• 4. Possible Security Issues
• 5. Operational Issues
• 6. Impact on HTTP Upgrade with Existing Upgrade Tokens
• 7. Guidance for Future Upgrade Tokens
• 8. Requirements for HTTP CONNECT
• 9. Security Considerations
• 10. IANA Considerations
• 11. References
• Acknowledgments
• Author's Address

Related Resources

• Official Text: RFC 9931
• Official Page: RFC 9931 DataTracker
• Errata: RFC Editor Errata