Re: 2.2. Interaction with "https" URIs | Re: Op-sec simplification

[Martin Thomson <[e-mail]>]

On 3 November 2016 at 07:02, Erik Nygren <[e-mail]> wrote:
> An example of why this could be bad would be a CDN server that terminates
> both HTTP and HTTPS over TLS but demuxes them such that HTTPS requires TLS
> to content origin but HTTP is allowed to go cleartext to content origin.
> When a single TLS connection demuxes to a mixture of TLS and cleartext
> traffic, this feels like asking for increased trouble and attack surfaces.
> Prohibiting mixed-scheme on the incoming connection makes this feel much
> safer.

I am almost inclined to say that you don't get to use the feature if
you are concerned about this causing issues of that sort.  Or, as some
of us have discussed, a new h2 setting that prohibits coalescing might
be a simpler option.

Kari's solution works, though it opens other possibilities, and I'm
concerned we're off down the rabbit hole again:

{ "http://...": "mixed-scheme", --> open season
  "http://...": "single-scheme", --> only one scheme per connection
  "http://...": "dedicated-connection" } --> only one origin per connection