Tags: dteh/dhttp
Tags
feat(transport): configurable HTTP/2 client fingerprint (SETTINGS + w…
…indow)
Add Transport.HTTP2Settings (*HTTP2Settings) so callers can control the HTTP/2
"Akamai" fingerprint the client emits on a new connection: the ordered SETTINGS
list and the initial connection-level WINDOW_UPDATE. Previously only the TLS
ClientHello (ClientHelloSettings) and header order were tunable, so a
uTLS-parroted client still sent Go's default H2 SETTINGS — a fingerprint
mismatch that anti-bot CDNs (Cloudflare/Akamai) detect even when JA3/JA4 match.
When set, newClientConn emits exactly the configured SETTINGS in order and uses
the configured connection window, aligning the client's per-stream receive-flow
accounting to the advertised INITIAL_WINDOW_SIZE. When nil, Go's defaults are
sent (unchanged behavior). Chrome, for example:
HTTP2Settings{Settings: {{1,65536},{2,0},{4,6291456},{6,262144}},
ConnectionFlow: 15663105}
[release-branch.go1.24] net/http: persist header stripping across rep… …eated redirects When an HTTP redirect changes the host of a request, we drop sensitive headers such as Authorization from the redirected request. Fix a bug where a chain of redirects could result in sensitive headers being sent to the wrong host: 1. request to a.tld with Authorization header 2. a.tld redirects to b.tld 3. request to b.tld with no Authorization header 4. b.tld redirects to b.tld 3. request to b.tld with Authorization header restored Thanks to Kyle Seely for reporting this issue. For #70530 Fixes #71212 Fixes CVE-2024-45336 Change-Id: Ia58a2e10d33d6b0cc7220935e771450e5c34de72 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1641 Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Commit-Queue: Roland Shoemaker <bracewell@google.com> (cherry picked from commit 2889169b87a61f1218a02994feb80fd3d8bfa87c) Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1766 Reviewed-on: https://go-review.googlesource.com/c/go/+/643100 Auto-Submit: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com>
[release-branch.go1.23] net/http: persist header stripping across rep… …eated redirects When an HTTP redirect changes the host of a request, we drop sensitive headers such as Authorization from the redirected request. Fix a bug where a chain of redirects could result in sensitive headers being sent to the wrong host: 1. request to a.tld with Authorization header 2. a.tld redirects to b.tld 3. request to b.tld with no Authorization header 4. b.tld redirects to b.tld 3. request to b.tld with Authorization header restored Thanks to Kyle Seely for reporting this issue. For #70530 Fixes ##71211 Fixes CVE-2024-45336 Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1641 Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Commit-Queue: Roland Shoemaker <bracewell@google.com> Change-Id: I326544358de71ff892d9e9fe338252a5dd04001f Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1764 Reviewed-on: https://go-review.googlesource.com/c/go/+/643104 Auto-Submit: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com>
PreviousNext