"is http2" detection doesn't seem quite correct
Closed this issue · 5 comments
wai/warp/Network/Wai/Handler/Warp/Run.hs
Line 390 in 2a7399f
Here we seem to determine whether this is an HTTP/2 request by reading some bytes off the wire, and if they are PRI
, it is.
But there's no guarantee we read 4 bytes, of course. We could read PR
, determine this isn't an HTTP/2 request, go down the HTTP/1 code path and proceed to read the remaining I
!
Right.
But a question is whether or not we should rescue this corner case.
Why is that a question?
Clients to send a few bytes at the beginning seem malicious.
Should we treat them kindly?
@kazu-yamamoto For sure; it's clearly a corner case. Nonetheless, it's exactly the kind of thing I would expect to be handled correctly in a web server!
Regarding this,
Clients to send a few bytes at the beginning seem malicious.
My understanding is that even if an honest client sends a legitimately-sized "packet" of bytes, the server can nonetheless read an arbitrary number of them at each call to read()
.