Description
HTTP/1.1 is susceptible to desync attacks. This is most relevant when using Reverse Proxies.
See this great writeup by James Kettle: https://portswigger.net/kb/papers/dzmxreq/http1-must-die.pdf
Use Case
I think for a security application with focus on reverse-proxies this is a must-have. As far as i can tell, a desync could allow an attacker to redirect to a malicious website and also to steal a session. Although I lack the skill to test this personally.
Details
No response
Documentation
No response
Generative AI
No
Pre-Submission Checklist
Description
HTTP/1.1 is susceptible to desync attacks. This is most relevant when using Reverse Proxies.
See this great writeup by James Kettle: https://portswigger.net/kb/papers/dzmxreq/http1-must-die.pdf
Use Case
I think for a security application with focus on reverse-proxies this is a must-have. As far as i can tell, a desync could allow an attacker to redirect to a malicious website and also to steal a session. Although I lack the skill to test this personally.
Details
No response
Documentation
No response
Generative AI
No
Pre-Submission Checklist
I agree to follow the Code of Conduct
I have checked for related issues and checked the documentation