Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
Since HTTP/2 is starting to get adopted by more and more sites everyday. Are there any security benefits or known risks regarding HTTP/2?
asked Mar 16, 2017 at 21:37
Bob OrtizBob Ortiz
6,3371010 gold badges4747 silver badges9191 bronze badges
RFC 7540 Section 10 is a security consideration section that documents a number of security considerations when implementing and/or using HTTP/2. Briefly:
- 10.1. Server Authority
- 10.2. Cross-Protocol Attacks
- 10.3. Intermediary Encapsulation Attacks
- 10.4. Cacheability of Pushed Responses
- 10.5. Denial-of-Service Considerations
- 10.5.1. Limits on Header Block Size
- 10.5.2. CONNECT Issues
- 10.6. Use of Compression
- 10.7. Use of Padding
- 10.8. Privacy Considerations
Most of the regular security considerations for HTTP/1 are also still valid, as HTTP/2 has the same application level semantic as HTTP/1.
answered Mar 17, 2017 at 2:25
Lie RyanLie Ryan
31.3k66 gold badges6969 silver badges9393 bronze badges
From a cryptographic point of view, HTTP/2 requires to support at least TLS1.2 which means the communication channel will be encrypted using AEAD ciphers i.e. state-of-the-art crypto.
answered Mar 17, 2017 at 6:17
31611 silver badge55 bronze badges
You must log in to answer this question.
Not the answer you're looking for? Browse other questions tagged