Hello everyone, >From what I understand, the Apache-related problems mentioned in PortSwigger's article [1] concerning h2 are fixed in the latest Apache Version 2.4.50. However, there remain other Problems with h2 downgrading on a reverse proxy that are outside of Apache's control, which is why it would be best to prevent h2 downgrading if possible. To use h2 for communicating with the backend application, we would need to use mod_proxy_http2 which is still marked as experimental in the official documentation. [2] Aside from the fact that it is marked as experimental, it there any information about its maturity and is there already an estimate, when mod_proxy_http2 will be released as stable? Any comments would be greatly appreciated, thank you! Best, Simon [1] https://portswigger.net/research/http2 [2] https://httpd.apache.org/docs/2.4/en/mod/mod_proxy_http2.html --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|