lua-http

lua-http copied to clipboard

daurnimator

e.g. if you only want to allow cookies for certain domains

daurnimator

It only closes the listening/accepting socket; it doesn't stop connections from handling new streams.

daurnimator

Support HTTPS over HTTPS proxies

3

[Currently an NYI](https://github.com/daurnimator/lua-http/blob/538ce79ed2acc8bbdee40b168bd2652be018bf03/http/request.lua#L393) Links: - https://daniel.haxx.se/blog/2016/11/26/https-proxy-with-curl/ - [curl commit](https://github.com/curl/curl/commit/cb4e2be7c6d42ca0780f8e0a747cecf9ba45f151) - https://bugzilla.mozilla.org/show_bug.cgi?id=378637 - https://dev.chromium.org/developers/design-documents/secure-web-proxy

daurnimator

- [Draft Spec](https://tools.ietf.org/html/draft-ietf-httpbis-expect-ct-06) - https://scotthelme.co.uk/a-new-security-header-expect-ct/ - [Chrome feature](https://www.chromestatus.com/feature/5677171733430272) available since chrome 61 # Client side support - [x] Support for Expect-CT header in lpeg_patterns (Tracking issue: https://github.com/daurnimator/lpeg_patterns/issues/11) - [ ]...

daurnimator

https://en.m.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities - Need luaossl to bind DANE functions - In http.client, need to do DNS lookup of TLSA records and add them to the SSL object - Would be easier...

daurnimator

Client connection pooling

1

Should probably be done at the `http.client` level? Need a 'multi-key' cache structure that allows us to index by a tuple of host, port, version, tls context, etc. Need a...

daurnimator

Refuse weak DH groups

4

There are at least two kinds of weak DH groups that `lua-http` silently accepts: - [ ] groups with [small subgroups](https://dh-small-subgroup.badssl.com/); - [ ] [composite groups](https://dh-composite.badssl.com/). I'm not sure whether...

KellerFuchs

Support `get_next_active_stream` on client connections

4

It's a bit cumbersome right now to receive from multiple streams on a same connection, as it basically requires a nested cq for each stream. Not sure what would be...

vavrusa

Support OCSP-Must-Staple

8

[OCSP-Must-Staple](https://wiki.mozilla.org/CA:ImprovingRevocation#OCSP_Must-Staple) makes certificate revocation work and scale: it is a standardized [X.509 extension](https://tools.ietf.org/html/rfc7633) that specifies that the user agent must do a hard-fail revocation check, using a stapled OCSP response....

KellerFuchs