Skip to content

Commit ff12044

Browse files
committed
Add a paragraph about HTTP/2 compressed headers security risk
1 parent 3eaa67d commit ff12044

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

doc/src/guide/protocols.asciidoc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,15 @@ cancellation mechanism which allows Gun to inform the
6565
server to stop sending a response for this particular
6666
request, saving resources.
6767

68+
Note that because HTTP/2 headers are compressed, there
69+
are scenarios where it is possible to probe or extract
70+
data, creating security risks. One scenario being the
71+
use of Gun as a proxy to create a single connection to
72+
an origin, with requests coming from multiple mutually
73+
distrustful entities. Gun will provide configuration
74+
options to restrict headers that can be compressed in
75+
a future release.
76+
6877
=== Websocket
6978

7079
Websocket is a binary protocol built on top of HTTP that

0 commit comments

Comments
 (0)