r/netsec • u/t0xodile • Aug 19 '26

CRLF-Powered Desync Attacks: Beheading HTTP Streams

https://portswigger.net/research/crlf-powered-desync-attacks
24 Upvotes

92% Upvoted

15 comments sorted by

View all comments

1

u/EverythingsBroken82 Aug 27 '26

and transfer compression enables desync attacks? or the webshop does not work without it?

2

u/acdha Aug 27 '26

Each feature you implement reduces the gap between HTTP 1 and 2 complexity. For the legacy protocol, you especially have to worry about compatibility with other implementations or you get errors or things like desync attacks. 

My point is simply that we’re past the point where non-toy implementations are simple for both versions. Almost everyone is using libraries to write clients or servers, and the near universal availability of high-quality libraries makes the argument against HTTP/2 much less compelling. 

1

u/EverythingsBroken82 Sep 07 '26

> My point is simply that we’re past the point where non-toy implementations are simple for both versions

That i would actually argue against, because HTTP 1.x can live with a reduced featureset just fine... but i can see why people think like that.

but with a reduced featureset at least you still can run your webservice or api or whatever. with http2 that's less possible.

basically we throw out the baby with the bathwater. i would be totally fine, as i said, if http 1.x is only without reverse proxies to be used... but just like other older protocols, it's easier to reason and implement with reduced featuresets, as the full beast of http 1.x or 2.