element-hq / element-hq/synapse

Support `h2c` (HTTP/2) for listeners, to mitigate against HTTP desync attacks

Open
#19,322 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

When a listener's type is `http` and tls is `false`, please also support `h2c` protocol. Currently, only HTTP 1.1 is supported in this case. When trying to connect via HTTP/2, there are errors in the log and the request is ignored.

Client:
```
# docker compose exec synapse curl --http2-prior-knowledge http://localhost:8008/
curl: (16) Remote peer returned unexpected data while we expected SETTINGS frame. Perhaps, peer does not support HTTP/2 properly.
```

Server log:
```
synapse.http.site - 422 - INFO - sentinel - Connection from IPv6Address(type='TCP', host='::1', port=50648, flowInfo=0, scopeID=0) lost before request headers were read
```

HTTP/2 is useful for running behind reverse proxies when they commonly terminate the SSL, so the connection from reverse proxy to Synapse is not transport encrypted.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.