Collaborate Disseminate
I recently had to MiTM an HTTP/2 connection over TLS and realized there is no MiTM tool out there that fully supports HTTP/2 over TLS, and no articles/blog posts written about this topic. After struggling with this for a whil… Continue reading How to MiTM HTTP/2 Traffic
HTTP, the foundation for data communication over the web, wasn’t designed for delivering the rich content that is common in today’s websites. HTTP/2, which represents a major update to the HTTP network protocol, has been introduced to deliver such websites and provides a significant improvement in the performance, security and privacy of today’s web. Continue reading HTTP/2 Will be Automatically Enabled by Default on the Akamai Intelligent Edge Platform
Overzealous use of HTTP/2 flow control settings in IIS could have brought servers to their knees. Continue reading Microsoft fixes web server DDoS bug
Key personnel at the Internet Engineering Task Force (IETF) have suggested basing the next version of a core web protocol on Google technology. Continue reading HTTP/3: Come for the speed, stay for the security
We are currently busy improving an Android application with connects to an Azure App Service API using client certificates and bearer token for authentication over TLS 1.2.
We are investigating moving to HTTP/2 for bandwidth & perform… Continue reading Alternative to client certificate authentication with HTTP/2
I thought Wireshark successfully decrypted an encrypted HTTP/2.0 connection once it was pointed to pre-master secrets from Firefox after setting SSLKEYLOGFILE.
It shows the header when following the stream:
PRI * HTTP/2.0
… Continue reading How to read/decode/parse HTTP/2.0 capture decrypted by Wireshark?
I need some clarifications about the problems that CORS (Cross-Origin Resource Sharing) can cause.
Let’s suppose that site A.COM has enabled CORS, in particular:
Access-Control-Allow-Origin can be set to any website in the … Continue reading CORS clarification
Apple released iOS 11 and found that the mail app cannot connect to Exchange Online or Exchange 2016. It’s all to do with HTTP2 connections. Apple tries to connect via ActiveSync but doesn’t do so the way that Exchange likes, or something like that. In any case, maybe now’s the time to consider Outlook for iOS.
The post iOS 11 and Exchange 2016/Online: Not Kissing Cousins appeared first on Petri.
Continue reading iOS 11 and Exchange 2016/Online: Not Kissing Cousins
A vulnerability report states the following:
The server is configured to support ciphers known as static key ciphers. These ciphers don’t support “Forward Secrecy”. In the new specification for HTTP/2, these ciphers have been blacklist… Continue reading Static Key Ciphers and key persistence
This question already has an answer here:
Can HTTPS server configured without a server certificate?
5 answers
Can we have h… Continue reading Must one have SSL certificates for each domain, to use HTTPS? [duplicate]