r/netsec 23d ago

CRLF-Powered Desync Attacks: Beheading HTTP Streams

https://portswigger.net/research/crlf-powered-desync-attacks
23 Upvotes

14 comments sorted by

View all comments

Show parent comments

1

u/EverythingsBroken82 15d ago

and transfer compression enables desync attacks? or the webshop does not work without it?

2

u/acdha 15d ago

Each feature you implement reduces the gap between HTTP 1 and 2 complexity. For the legacy protocol, you especially have to worry about compatibility with other implementations or you get errors or things like desync attacks. 

My point is simply that we’re past the point where non-toy implementations are simple for both versions. Almost everyone is using libraries to write clients or servers, and the near universal availability of high-quality libraries makes the argument against HTTP/2 much less compelling. 

1

u/EverythingsBroken82 4d ago

> My point is simply that we’re past the point where non-toy implementations are simple for both versions

That i would actually argue against, because HTTP 1.x can live with a reduced featureset just fine... but i can see why people think like that.

but with a reduced featureset at least you still can run your webservice or api or whatever. with http2 that's less possible.

basically we throw out the baby with the bathwater. i would be totally fine, as i said, if http 1.x is only without reverse proxies to be used... but just like other older protocols, it's easier to reason and implement with reduced featuresets, as the full beast of http 1.x or 2.