envoyproxy / envoyproxy/envoy

Unify header validation across all codecs (H1, H2 and H3)

Open
#10,646 27 comments 0 reactions 1 assignee Claimed by @yanavlasov View on GitHub
area/http area/quic area/security help wanted tech debt
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
437

Description

Presently H1 and H2 codecs use header validation which is a mix of the codec specific and some checks from nghttp2 library on top of it. This leads to inconsistencies in header validation across codecs and makes header validation hard to audit.

For more information see [design specifications](https://docs.google.com/document/d/1iRprAqZt3dek107LZWtBTnb2YRRhUBanBnHvHKMPdkI/edit?usp=sharing).

This change will include:
1. Adding header validation according to the HTTP spec.
1. Converting codecs to use unified header validation facility. This will only be applied for Balsa and oghttp2 codecs.

Deployment plan:

1. Add opt-in for universal header validation for Balsa and oghttp2 in compatibility mode (fully compatible with the http-parser and nghttp2)
2. After bake-in interval (i.e. one full release cycle) change the feature to opt-out
3. Turn-off compatibility features to bring HTTP validation to RFC compliance one by one.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.