Skip to main content

Questions tagged [http2]

HTTP/2 - Hypertext Transport Protocol with field compression and multiplexing

Filter by
Sorted by
Tagged with
0 votes
1 answer
206 views

Is it possible to disable or change sec-fetch-* HTTP headers?

I might have found a way to highjack an Oauth Flow, but the source server is responding with 403 errors when the Oauth request is sent with a Sec-Fetch-Dest HTTP header. Is there a way to alter or ...
user2284570's user avatar
  • 1,482
0 votes
1 answer
168 views

CRLF in HTTP/2 header value

I am attempting to inject a carriage-return + newline in a HTTP request header value. My understanding is that this is possible with HTTP/2 and HTTP/3. However, when I send a request with Burp I get ...
Sjoerd's user avatar
  • 31.8k
0 votes
0 answers
309 views

How to properly use cURL --data-binary to send a request payload

This question is out of pure curiosity. I know I can send multipart formposts using curl's --form/-F option. However, I was curious to see if the same can be done with the --data-binary option? For ...
Майкл Шодеке's user avatar
1 vote
0 answers
152 views

Code to detect HTTP/2 Rapid Reset Attack vulnerability

Is there code/library to detect this vulnerability? I have been searching online and do not find any We are using Cloudflare which has fixed the issue but government says "we may" have the ...
Matias Haeussler's user avatar
0 votes
1 answer
155 views

OAuth2 implicit flow - is it still possible to hijack the token with HTTPS?

The video from Okta says that it's possible to hijack the access token when on public wifi. But if HTTPS is used, the headers are encrypted. And therefore the Location returned by the Auth Server won'...
Stanislav Bashkyrtsev's user avatar
0 votes
0 answers
184 views

HTTP Request Smuggling Exploit - Need Clarification on Behavior of the 'Host' Header

I've been reading about HTTP Request Smuggling attacks and I've come across a situation that I don't fully understand. I've been studying the report by James Kettle where he describes an attack ...
jack's user avatar
  • 1
5 votes
1 answer
434 views

Does HTTP/3 necessitate additional - beyond HTTP/2 via TLS1.3 - restrictions on client authentication (mTLS)?

A recent Nginx release allows me to set listen 443 quic; to enable HTTP/3. Neat. I had been using HTTP/2 with TLS1.3 before, so I did not expect that change much, just optimize round trips with ...
anx's user avatar
  • 370
0 votes
1 answer
201 views

CRIME and BREACH attacks, HTTP/2 and HTTP/3

I have been reading on CRIME and BREACH attacks and I want to learn better how to protect against them. From what I understood, those attacks require TLS encryption over HTTP compression and HTTP ...
Alexandre's user avatar
  • 101
1 vote
1 answer
81 views

Are there HTTP/2 specific attacks different from request smuggling?

I'm researching information about HTTP/2 from a cybersecurity point of view for an article, and i wanted to include a section about attacks exclusive to HTTP/2 or were this protocol have a key role. I ...
kiratross's user avatar
2 votes
0 answers
658 views

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability? I understand that the best way to ...
Sai Vishnu's user avatar
2 votes
1 answer
270 views

Timeless timing attacks and response jitter

I've been researching timeless timing attacks, ie: timing attacks using concurrency rather than round trip time. Here is an article by portswigger with links to the original article by Van Goethem. ...
wade king's user avatar
  • 123
0 votes
1 answer
426 views

Nessus Plugin "HTTP Smuggling Detection" failing due to support for http/1.1 - how to overcome?

A new Nessus plugin (140735 - HTTP Smuggling Detection) was very recently incorporated into Tenable's PCI template and is now beeing flagged as a "medium" vulnerability and causing scans to ...
B Robster's user avatar
  • 103
9 votes
1 answer
2k views

Does HTTP/2 prevent security vulnerabilites like CRLF injection?

Which vulnerabilites does HTTP/2 prevent? More specifically: Does it prevent HTTP request smuggling? Does it prevent HTTP response splitting / CRLF injection?
Machine Yadav's user avatar
22 votes
2 answers
5k views

Is there any point in having the HSTS header enabled when using HTTP/2?

As a protection against attacks such as SSLstrip, the HSTS header prevents an attacker from downgrading a connection from HTTPS to HTTP, as long as the attributes of the header are properly configured....
user96649's user avatar
  • 363
-1 votes
2 answers
3k views

Interpreting SSLLabs Handshake simulation results

While testing SSL/TLS details on ssllabs.com for a website, the Handshake Simulation part contains: TLS 1.2 > http/1.1 TLS 1.2 > h2 For eg: What do these things mean? I couldn't find it ...
Pankaj Singhal's user avatar
4 votes
2 answers
3k views

How to MiTM HTTP/2 Traffic

I recently had to MiTM an HTTP/2 connection over TLS and realized there is no MiTM tool out there that fully supports HTTP/2 over TLS, and no articles/blog posts written about this topic. After ...
c0mpute's user avatar
  • 81
7 votes
2 answers
2k views

Alternative to client certificate authentication with HTTP/2

We are currently busy improving an Android application with connects to an Azure App Service API using client certificates and bearer token for authentication over TLS 1.2. We are investigating ...
Preben Huybrechts's user avatar
1 vote
2 answers
239 views

CORS clarification

I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause. Let's suppose that site A.COM has enabled CORS, in particular: Access-Control-Allow-Origin can be ...
Edge7's user avatar
  • 130
1 vote
0 answers
158 views

Converting HTTP/2 without TLS traffic into HTTP/1.1 [closed]

I'd like to have a listener understanding HTTP/2 without TLS ("prior knowledge HTTP/2"). The listener should then translate the received traffic into HTTP/1.1 and forward it to a desired location. ...
bgd223's user avatar
  • 363
0 votes
1 answer
7k views

Static Key Ciphers and key persistence

A vulnerability report states the following: The server is configured to support ciphers known as static key ciphers. These ciphers don't support "Forward Secrecy". In the new specification for ...
JohnEye's user avatar
  • 143
0 votes
1 answer
249 views

Must one have SSL certificates for each domain, to use HTTPS? [duplicate]

I read in the following passage in this DigitalOcean article, concerning HTTP/2: Even though HTTP/2 does not require encryption, developers of two most popular browsers, Google Chrome and Mozilla ...
user avatar
28 votes
2 answers
5k views

What are possible security problems of enabling HTTP2?

I want to enable HTTP2 for several web servers but I'm worried about the possible security implications. I think about something like: HTTP2 implementations are maybe more error prone than mature ...
40F4's user avatar
  • 922
0 votes
1 answer
149 views

Are URLs viewed during HTTPS/2 transactions to one or more websites from a single IP distinguishable?

This is a follow up to the original question Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable? D.W. provided an extensive summary on attack vectors ...
stwissel's user avatar
  • 103
5 votes
3 answers
17k views

Why can't we use POST method for all requests? [closed]

It is known that sensitive information should not be transmitted in GET requests as GET requests will be cached and POST should be used. Why can't we use POST method for all request and ignoring GET ...
Jaka's user avatar
  • 182
7 votes
2 answers
1k views

What are the security benefits or risks of HTTP/2?

Since HTTP/2 is starting to get adopted by more and more sites everyday. Are there any security benefits or known risks regarding HTTP/2?
Bob Ortiz's user avatar
  • 6,705
4 votes
1 answer
881 views

What security benefits does ALPN bring to TLS?

I've been recommending Application-Layer Protocol Negotiation (the successor to Next Protocol Negotiation) to people for a while, but recently realised that I actually don't have a concrete example of ...
Polynomial's user avatar
  • 135k
-8 votes
2 answers
311 views

HTTP websites vs HTTPS websites [closed]

Why do we say that an http website is not secure compared to an https website?
Sandra Ross's user avatar
3 votes
2 answers
10k views

Understanding blacklisted ciphers for HTTP2

I've been working on get HTTP2 support running on an Nginx server for some time now. At this point I'm stuck at selecting ciphers to support. Hopefully you can help me understand this. Before I ...
Evy Bongers's user avatar
2 votes
2 answers
9k views

Cipher suite selection for compatibility with http/2, and TLS 1.0-1.2

I have been attempting to configure my site to have http/2 support, but I kept having to remove cipher suites because of the blacklist. Eventually, I got the list whittled down sufficiently. The ...
Yet Another User's user avatar
2 votes
1 answer
230 views

Are there strong technical reasons for browsers mandating TLS for http2?

I realise there are similar questions around this topic, however, I think this is sufficiently different/focused not to be a duplicate. I hope it doesn't sound like a soapbox piece. HTTP/2 ...
Phil Lello's user avatar
  • 1,122
9 votes
2 answers
1k views

Why doesn't the HTTP/2 spec require TLS?

Although no browser implements the full HTTP/2 spec right now limiting themselves to just the TLS part there are stories on the internet that this incomplete implementation of the spec is a way of ...
David Mulder's user avatar
  • 1,376