tree 8ccb66a2abbac8c2b031df4d1c251c4bb907bdd5
parent 6b3cd2f4c5b7502f5f13f0c6cdbcf9730c28a673
author Vladimir Homutov <vl@nginx.com> 1634712602 +0300
committer Vladimir Homutov <vl@nginx.com> 1634712602 +0300

HTTP: connections with wrong ALPN protocols are now rejected.

This is a recommended behavior by RFC 7301 and is useful
for mitigation of protocol confusion attacks [1].

To avoid possible negative effects, list of supported protocols
was extended to include all possible HTTP protocol ALPN IDs
registered by IANA [2], i.e. "http/1.0" and "http/0.9".

[1] https://alpaca-attack.com/
[2] https://www.iana.org/assignments/tls-extensiontype-values/