draft-ietf-httpbis-optimistic-upgrade-03.txt		draft-ietf-httpbis-optimistic-upgrade-latest.txt
	HTTPBIS Working Group		HTTPBIS Working Group
	Internet-Draft Meta Platforms, Inc.		Internet-Draft Meta Platforms, Inc.
	Updates: 9112, 9298 (if approved) April 03, 2025		Updates: 9112, 9298 (if approved) May 19, 2025
	Intended status: Standards Track		Intended status: Standards Track
	Expires: October 5, 2025		Expires: November 20, 2025
	Security Considerations for Optimistic Protocol Transitions in HTTP/1.1		Security Considerations for Optimistic Protocol Transitions in HTTP/1.1
	draft-ietf-httpbis-optimistic-upgrade-03		draft-ietf-httpbis-optimistic-upgrade-latest
	Abstract		Abstract
	In HTTP/1.1, the client can request a change to a new protocol on the		In HTTP/1.1, the client can request a change to a new protocol on the
	existing connection. This document discusses the security		existing connection. This document discusses the security
	considerations that apply to data sent by the client before this		considerations that apply to data sent by the client before this
	request is confirmed, and updates RFC 9298 to avoid related security		request is confirmed, and updates RFC 9298 to avoid related security
	issues.		issues.
	About This Document		About This Document
	skipping to change at page 1, line 46 ¶		skipping to change at page 1, line 46 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at https://datatracker.ietf.org/drafts/current/.		Drafts is at https://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on October 5, 2025.		This Internet-Draft will expire on November 20, 2025.
	Copyright Notice		Copyright Notice
	Copyright (c) 2025 IETF Trust and the persons identified as the		Copyright (c) 2025 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(https://trustee.ietf.org/license-info) in effect on the date of		(https://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	skipping to change at page 7, line 20 ¶		skipping to change at page 7, line 20 ¶
	Datagrams before receiving the response to its UDP proxying		Datagrams before receiving the response to its UDP proxying
	request.		request.
	However, in HTTP/1.1, this "proxying request" is an HTTP Upgrade		However, in HTTP/1.1, this "proxying request" is an HTTP Upgrade
	request. This upgrade is likely to be rejected in certain		request. This upgrade is likely to be rejected in certain
	circumstances, such as when the UDP destination address (which is		circumstances, such as when the UDP destination address (which is
	attacker-controlled) is invalid. Additionally, the contents of the		attacker-controlled) is invalid. Additionally, the contents of the
	"connect-udp" protocol stream can include untrusted material (i.e.,		"connect-udp" protocol stream can include untrusted material (i.e.,
	the UDP packets, which might come from other applications on the		the UDP packets, which might come from other applications on the
	client device). This creates the possibility of Request Smuggling		client device). This creates the possibility of Request Smuggling
	attacks. To avoid these concerns, this text is updated as follows:		attacks. To avoid these concerns, this document updates that text to
			exclude HTTP/1.1 from any optimistic sending, as follows:
	When using HTTP/2 or later, a client MAY optimistically ...		When using HTTP/2 or later, a client MAY optimistically ...
	Section 3.3 of [RFC9298] describes the requirement for a successful		Section 3.3 of [RFC9298] describes the requirement for a successful
	proxy setup response, including upgrading to the "connect-udp"		proxy setup response, including upgrading to the "connect-udp"
	protocol, and says:		protocol, and says:
	If any of these requirements are not met, the client MUST treat		If any of these requirements are not met, the client MUST treat
	this proxying attempt as failed and abort the connection.		this proxying attempt as failed and abort the connection.
End of changes. 5 change blocks.
	5 lines changed or deleted		6 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/