How to disable HTTP/1.1? And disable downgrading to HTTP/1.1 on Tomcat?
Asked Answered
T

0

3

I need to leave possibility to execute requests only with HTTP/2 protocol.

System: Apache Tomcat 8, configured to use the HTTP/2 protocol.

  1. I execute this request with --http2 and get result:

    Testing with HTTP/2

  2. Next I execute this request with --http1.1 and get result enter image description here

This picture means that I still can use HTTP/1.1, but I want to disable it.

How to prevent executing HTTP/1.1 request on Tomcat?

Topi answered 27/9, 2022 at 8:8 Comment(4)
Why do you need to do that?Undone
I need this for preventing "HTTP Request smuggling" vulnerability, which is present in HTTP/1.1 protocol and earlier versions. In HTTP/2 protocol this vulnerability is solved.Ejaculatory
In the future, please do not upload images of code/data/errors when asking a question.. The output of curl for example can easily be posted as text, which is much more accessible.Arneson
This Serverfault question has some limited information on the topic.Arneson

© 2022 - 2024 — McMap. All rights reserved.