Questions tagged [http2]
The http2 tag has no usage guidance.
3
votes
2answers
92 views
How to MiTM HTTP/2 Traffic
I recently had to MiTM an HTTP/2 connection over TLS and realized there is no MiTM tool out there that fully supports HTTP/2 over TLS, and no articles/blog posts written about this topic. After ...
3
votes
1answer
162 views
Alternative to client certificate authentication with HTTP/2
We are currently busy improving an Android application with connects to an Azure App Service API using client certificates and bearer token for authentication over TLS 1.2.
We are investigating ...
1
vote
2answers
92 views
CORS clarification
I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause.
Let's suppose that site A.COM has enabled CORS, in particular:
Access-Control-Allow-Origin can be ...
1
vote
0answers
62 views
Converting HTTP/2 without TLS traffic into HTTP/1.1 [closed]
I'd like to have a listener understanding HTTP/2 without TLS ("prior knowledge HTTP/2"). The listener should then translate the received traffic into HTTP/1.1 and forward it to a desired location.
...
1
vote
1answer
3k views
Static Key Ciphers and key persistence
A vulnerability report states the following:
The server is configured to support ciphers known as static key ciphers. These ciphers don't support "Forward Secrecy". In the new specification for ...
0
votes
1answer
99 views
Must one have SSL certificates for each domain, to use HTTPS? [duplicate]
I read in the following passage in this DigitalOcean article, concerning HTTP/2:
Even though HTTP/2 does not require encryption, developers of two most
popular browsers, Google Chrome and Mozilla ...
29
votes
2answers
4k views
What are possible security problems of enabling HTTP2?
I want to enable HTTP2 for several web servers but I'm worried about the possible security implications. I think about something like:
HTTP2 implementations are maybe more error prone than mature ...
0
votes
1answer
69 views
Are URLs viewed during HTTPS/2 transactions to one or more websites from a single IP distinguishable?
This is a follow up to the original question Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?
D.W. provided an extensive summary on attack vectors ...
-1
votes
3answers
4k views
Why can't we use POST method for all requests? [closed]
It is known that sensitive information should not be transmitted in GET requests as GET requests will be cached and POST should be used.
Why can't we use POST method for all request and ignoring GET ...
6
votes
2answers
685 views
What are the security benefits or risks of HTTP/2?
Since HTTP/2 is starting to get adopted by more and more sites everyday. Are there any security benefits or known risks regarding HTTP/2?
3
votes
1answer
310 views
What security benefits does ALPN bring to TLS?
I've been recommending Application-Layer Protocol Negotiation (the successor to Next Protocol Negotiation) to people for a while, but recently realised that I actually don't have a concrete example of ...
-9
votes
2answers
197 views
HTTP websites vs HTTPS websites [closed]
Why do we say that an http website is not secure compared to an https website?
3
votes
2answers
6k views
Understanding blacklisted ciphers for HTTP2
I've been working on get HTTP2 support running on an Nginx server for some time now. At this point I'm stuck at selecting ciphers to support. Hopefully you can help me understand this.
Before I ...
1
vote
2answers
4k views
Cipher suite selection for compatibility with http/2, and TLS 1.0-1.2
I have been attempting to configure my site to have http/2 support, but I kept having to remove cipher suites because of the blacklist. Eventually, I got the list whittled down sufficiently.
The ...
2
votes
1answer
150 views
Are there strong technical reasons for browsers mandating TLS for http2?
I realise there are similar questions around this topic, however, I think this is sufficiently different/focused not to be a duplicate. I hope it doesn't sound like a soapbox piece.
HTTP/2 ...
6
votes
2answers
648 views
Why doesn't the HTTP/2 spec require TLS?
Although no browser implements the full HTTP/2 spec right now limiting themselves to just the TLS part there are stories on the internet that this incomplete implementation of the spec is a way of ...
