Subject: Header compression integrity

From: Tatsuhiro Tsujikawa <[email-masked]>
Date: Sun, 28 Jul 2013 12:56:32 +0900

Under the current header compression scheme, the receiver has no way to
check that the received header set is what the sender intended to transmit.
I think it would be good to add some kind of integrity checking against
uncompressed header sets(e.g., parity, hash, etc).

This problem does not occur if both ends correctly implement header
compression. But there are several corner cases (index shadowing, etc) and
its implementation complexity is certainly higher than current HTTP/1.1 and
SPDY, it may go wrong easier than before.

For example, if client encodes index badly (off-by-one error, for example),
the server may see the wrong index. The thing is this might not be
noticeable in one request/response. It might be apparent after several
requests, possibly after eviction occurs. This problem is more serious for
proxy. If proxy coalesces streams for requests to different origin servers
just like what secure SPDY proxy does, misinterpreting headers may leak
cookies to other unintended sites.

Best regards,

Tatsuhiro Tsujikawa

---

From: Martin Thomson <[email-masked]>
Date: Sun, 28 Jul 2013 00:51:25 -0700

> uncompressed header sets(e.g., parity, hash, etc).

This is an interesting suggestion.  Perhaps our initial
interoperability testing will allow us to discover how likely this is
going to be.  The only thing that bothers me is the eviction scheme,
but the -01 draft seems to be clear enough.  If things get more
complex, or we discover problems, then maybe a sanity check might be
appropriate.