http-extensions icon indicating copy to clipboard operation
http-extensions copied to clipboard

Determine the status of "Upgrade: HTTP/2.0"

Open bemasc opened this issue 1 year ago • 0 comments

The IANA Upgrade Token Registry lists an entry for HTTP/*.*, and specifically identifies "2.0" as a possible version value, as instructed by RFC 9110 Section 18.10. However, this flow seems to have been superseded by "Upgrade: h2c", which was introduced in RFC 7540 and deprecated in RFC 9113. I am not aware of any implementations of "Upgrade: HTTP/2.0" in clients or servers.

I think we have two main options:

  1. Status Quo: Regard "HTTP/*.*" as a mechanism that is formally defined but not implemented anywhere. Provide formal analysis of its security for completeness.
  2. Deprecation: Update RFC 9110 in this draft to remove the definition of this upgrade token. Mark "HTTP" as "obsolete" in the Upgrade Tokens Registry.

bemasc avatar Feb 15 '24 14:02 bemasc