1851439 - Add pref for EH over HTTP1.1

Status: RESOLVED FIXED

(Core :: Networking: HTTP, task, P2)

Description

[Valentin Gosu [:valentin] (he/him)]

We should have a static pref that controls whether we accept early hints sent over a H1.1 connection.

Comment 1

[Manuel Bucher [:manuel]]

What Early Hints RFC has to say about early hints over h1.1:

In particular, an HTTP/1.1 client that mishandles an informational response as a final response is likely to consider all responses to the succeeding requests sent over the same connection to be part of the final response. Such behavior might constitute a cross-origin information disclosure vulnerability in case the client multiplexes requests to different origins onto a single persistent connection.

Therefore, a server might refrain from sending 103 (Early Hints) responses over HTTP/1.1 unless the client is known to handle informational responses correctly.

Comment 3

[Sean Kim]

Is there a way to check the HTTP version in MaybeCreateAndInsertPreload in EarlyHintPreloader.cpp? (referring to https://searchfox.org/mozilla-central/source/netwerk/protocol/http/EarlyHintPreloader.cpp#198)

Comment 4

[Valentin Gosu [:valentin] (he/him)]

The early hint is dispatched from here
We can check the version by checking mConnection->Version() or mResponseHead->Version().
The pref could go here.

You can probably check the pref in the if (status == 103) { line - something like pseudocode: if status == 103 && (allow_103_over_h1 || mResponseHead->Version() != h1)

Comment 5

[Sean Kim]

Attachment: Bug 1851439 - Add pref for EH over HTTP1.1 r=valentin,kershaw

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4be40b35fabe
Add pref for EH over HTTP1.1 r=kershaw,necko-reviewers

Comment 7

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/4be40b35fabe