Re: [quicwg/base-drafts] Import HTTP/2 Security Considerations (#3531)

[Mike Bishop <[e-mail]>]

@MikeBishop commented on this pull request.



> +the origin server in the Cache-Control header field. However, this can cause
+issues if a single server hosts more than one tenant.  For example, a server
+might offer multiple users each a small portion of its URI space.
+
+Where multiple tenants share space on the same server, that server MUST ensure
+that tenants are not able to push representations of resources that they do not
+have authority over.  Failure to enforce this would allow a tenant to provide a
+representation that would be served out of cache, overriding the actual
+representation that the authoritative tenant provides.
+
+Pushed responses for which an origin server is not authoritative (see
+{{connection-reuse}}) MUST NOT be used or cached.
+
+## Denial-of-Service Considerations
+
+An HTTP/3 connection can demand a greater commitment of resources to operate

Some implementations still experience higher resource usage for HTTP/3 for various reasons (lack of hardware offload, smaller encryption units, UDP less optimized than TCP, etc.).  While I hope that some of those things will change over time and the rest will matter less, I think it's still a generally true statement that HTTP/3 **can** demand greater resources.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3531#discussion_r398133513