Subject: Re: [httpwg/http-extensions] more HTTPS getout clause (227694d)

From: HTTP issue updates <[email-masked]>
Date: Wed, 01 Feb 2017 22:37:34 -0800

I'm sure that you're enjoying this as much as I am.  I'm sorry for being a huge pedant^WPITA, but this isn't right.

This is a non-statement: SNI is mandatory in HTTP/2 and if the connection isn't up to snuff, it will never reach the point that an ORIGIN frame can be received.

I think that you need to change step 4.3 below.  Maybe:

> If the certificate presented by the server is not valid for the `host` of `parsed_origin`, skip to the next `origin_raw`. The certificate presented by the server is valid for `host` if it passes the checks that the client would perform when forming a new TLS connection to the origin.  This includes verifying that the `host` matches a `dNSName` value from the certificate `subjectAltName` field (using the wildcard rules defined in {{!RFC2818}}).

We had a pretty bad bug in Firefox because we performed one set of checks for Alt-Svc, but failed to perform some fairly critical checks.  I don't want to see a repeat of that.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/commit/227694d092a8ce0fc88d044bdba8c0e4530eb2a9#commitcomment-20709189

---

From: HTTP issue updates <[email-masked]>
Date: Thu, 02 Feb 2017 15:55:23 -0800

It's a non-normative section, but OK.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/commit/227694d092a8ce0fc88d044bdba8c0e4530eb2a9#commitcomment-20723464