HTTP/2 mitigates against an entire class of vulnerabilities called "HTTP desync attack" or "HTTP smuggling". In short, this means because the backend connection between the reverse proxy and Radicale is shared between all users, an attacker can see content from users connecting to Radicale. This includes cookies, access tokens and maybe passwords.
It is not sufficient (actually has no effect) if you upgrade the frontend (between reverse proxy and web browser) connection to HTTP/2. Also, while reverse proxies try to protect against known attack vectors via regular expression hacks, new vectors come up frequently. The only known way to protect against these attacks is upgrade the backend to HTTP/2.
Radicale currently rejects H2C connections:
[1/Thread-2 (process_request_thread)] [ERROR] An error occurred during request: code 505, message Invalid HTTP version (2.0)
I was not able to find any configuration in the documentation about HTTP/2 or H2C. My proposal:
- Allow H2C and default to it
- Motivate existing users to switch from HTTP/1.1 to H2C
- Later, disable HTTP/1.1
More info:
https://www.youtube.com/watch?v=PUCyExOr3sE&t=2191s
https://http1mustdie.com/
HTTP/2 mitigates against an entire class of vulnerabilities called "HTTP desync attack" or "HTTP smuggling". In short, this means because the backend connection between the reverse proxy and Radicale is shared between all users, an attacker can see content from users connecting to Radicale. This includes cookies, access tokens and maybe passwords.
It is not sufficient (actually has no effect) if you upgrade the frontend (between reverse proxy and web browser) connection to HTTP/2. Also, while reverse proxies try to protect against known attack vectors via regular expression hacks, new vectors come up frequently. The only known way to protect against these attacks is upgrade the backend to HTTP/2.
Radicale currently rejects H2C connections:
[1/Thread-2 (process_request_thread)] [ERROR] An error occurred during request: code 505, message Invalid HTTP version (2.0)I was not able to find any configuration in the documentation about HTTP/2 or H2C. My proposal:
More info:
https://www.youtube.com/watch?v=PUCyExOr3sE&t=2191s
https://http1mustdie.com/