Subject: Re: [httpwg/http-extensions] Impact of Combining headers (#504)

From: HTTP issue updates <[email-masked]>
Date: Mon, 09 Apr 2018 05:31:43 +0000 (UTC)

Kari points out that wouldn't help (as the commas could be escaped by a dangling `\` at the end of the first header instance).

I don't think we can reliably fail, given that in some implementations, multiple instances of a header field are folded before they get to the parser.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504#issuecomment-379636903

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 09 Apr 2018 06:24:25 +0000 (UTC)

I think reliably not failing is fine. If you don't want header injection you need to disallow commas.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504#issuecomment-379646751

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 09 Apr 2018 06:26:26 +0000 (UTC)

Makes sense - we can mention that in Security Considerations.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504#issuecomment-379647141

---

From: HTTP issue updates <[email-masked]>
Date: Mon, 09 Apr 2018 23:32:19 +0000 (UTC)

Closed #504 via dd78f21f5dbf36bc8dc739fe1a4bfd8342240c9f.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504#event-1565002535