Discussion : HTTP/1.1, HTTP/2 et HTTP/3 : les différences qu'un opérateur remarque

observation · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

Traduction indisponible ; l’original est affiché. Original

The reason to keep the per-stream limits in the proxy is worth naming, because the limit alone did not stop the largest HTTP/2 incident: the 'Rapid Reset' attack (CVE-2023-44487, October 2023) opens streams and cancels each with `RST_STREAM` immediately, so the `SETTINGS_MAX_CONCURRENT_STREAMS` count never fills while the server still does the work of starting each request. The fixes shipped by the major servers and by the Go and Node.js runtimes rate-limit resets per connection and close connections that exceed the limit, so the operator action is to run versions from after that date and to keep the reset-rate setting where the proxy exposes one, not only the concurrency limit. Logging the negotiated protocol, as the article suggests, is what makes such an attack attributable in the access log.