You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
It’s possible to send header blocks from hyper-as-server that hyper-as-client will reject #262
We do a series of checks in the validate_headers pipeline for incoming header blocks, in particular:
All fields should be lowercase.
A Transfer-Encoding header must have value "trailers"
No blocks with the Connection header.
No duplicate pseudo-header fields and/or pseudo-header fields coming after an ordinary header field.
No header blocks with bad :authority/Host headers.
But we don’t enforce all these rules on header blocks that we send, which suggests that it’s possible to send a header block with hyper that we’d reject if we received. Which seems odd.
(1) is achieved by the _lowercase_header_names pipeline, and I’m adding (5) in #261. I think we should be enforcing (2)-(4) on header blocks that we send as well.
Activity
Lukasa commentedon Jul 21, 2016
I think we should enforce those too. =)
Lukasa commentedon Jul 21, 2016
I've updated the original comment to turn the list into a list of checkboxes so we can keep track. Feel free to tackle each one separately.
alexwlchan commentedon Aug 3, 2016
Note: if you’re going to tackle this, you should read the discussion on #246 about being able to skip these checks in certain cases.
alexwlchan commentedon Aug 30, 2016
All addressed in #289.