cloudflare/pingora

Full pipelining support

Opened this issue · 0 comments

DemiMarie commented

What is the problem your feature solves, or the need it fulfills?

Pingora currently does not support pipelining. This is problematic because it means that Pingora’s behavior is different than that of a correct HTTP/1.1 server. My understanding is that this was exploited in a desync attack. While that was fixed, full pipelining support would have prevented the bug.

Describe the solution you'd like

Pingora should support pipelining if possible. If this is not possible, it should immediately close the connection if any data is received from the client prior to the full response body being sent, but this does not conform to the HTTP/1.1 standard.

Describe alternatives you've considered

Continue to use ad hoc desync prevention measures.

Additional context