Use http2.originSet for socket/session re-use

[grantila]

As described here: https://nodejs.org/dist/latest-v9.x/docs/api/http2.html#http2_http2session_originset

[grantila]

Help on this is welcome, if it's of somewhat importance to anyone.

• Can the originSet be trusted to use as-is?
• Does Node.js filter invalid results?
• Does Node.js check that origins match the TLS origins to not have bad servers pretending to authorize 3rd party origins?

[colinbendell]

it appears that originSet always reports the current origin (servername from the TLS socket). I suspect that it was originally planned to reflect the Origin frame if the spec were to ever land. So currently originSet is not much use in practical use cases.

However, the session.socket.getPeerCertificate().subjectaltname does provide the available SANs on the connected certificate. I would propose that a new ContextOption that allows trusting TLS certificate without DNS lookup (or allow for DNS lookup as an elevated situation)

[szmarczak]

You can use http2wrapper.Agent. We already use http2-wrapper in Got.