element-hq / element-hq/synapse
Support `h2c` (HTTP/2) for listeners, to mitigate against HTTP desync attacks
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
When a listener's type is `http` and tls is `false`, please also support `h2c` protocol. Currently, only HTTP 1.1 is supported in this case. When trying to connect via HTTP/2, there are errors in the log and the request is ignored.
Client:
```
# docker compose exec synapse curl --http2-prior-knowledge http://localhost:8008/
curl: (16) Remote peer returned unexpected data while we expected SETTINGS frame. Perhaps, peer does not support HTTP/2 properly.
```
Server log:
```
synapse.http.site - 422 - INFO - sentinel - Connection from IPv6Address(type='TCP', host='::1', port=50648, flowInfo=0, scopeID=0) lost before request headers were read
```
HTTP/2 is useful for running behind reverse proxies when they commonly terminate the SSL, so the connection from reverse proxy to Synapse is not transport encrypted.
Contributor guide
Assessment
This issue has not been assessed yet.