Consideration for HTTP/3 Security

With the growing adoption of HTTP/3, it's crucial to address security concerns specific to its protocols and implementations. One key area is the header compression mechanism used in HTTP/3, known as QPACK. While QPACK enhances efficiency, it may also introduce vulnerabilities similar to those seen with HTTP/2's HPACK, particularly compression-based security attacks like CRIME and BREACH.

To start this discussion around HTTP/3 security, I want to propose this:

• Verify that HTTP/3 header compression (QPACK) is securely implemented to prevent compression-based attacks such as CRIME or BREACH. This verification should include checks to ensure that sensitive data is not subject to unsafe compression techniques that could expose information through side channels.