[GitHub] [tomcat] rmaucher commented on issue #277: Refuse adding invalid HTTP 2.0 headers

rmaucher commented on issue #277: URL: https://github.com/apache/tomcat/pull/277#issuecomment-618470184 Yes, it is accurate if there's a "connection: foobar" header, then there could be a "foobar" header and in that case it's tied to the connection header. Note about my earlier

[GitHub] [tomcat] rmaucher commented on issue #277: Refuse adding invalid HTTP 2.0 headers

rmaucher commented on issue #277: URL: https://github.com/apache/tomcat/pull/277#issuecomment-617758397 Still, -1, again for your patch. In addition to being ugly, there's no provision in the Servlet spec to throw an exception on random header names, especially common ones, so failing,

[GitHub] [tomcat] rmaucher commented on issue #277: Refuse adding invalid HTTP 2.0 headers

rmaucher commented on issue #277: URL: https://github.com/apache/tomcat/pull/277#issuecomment-617661025 The initial post says SHOULD, but after actually checking the spec it is a MUST. https://tools.ietf.org/html/rfc7540#section-8.1.2.2 It is really odd the specification made

[GitHub] [tomcat] rmaucher commented on issue #277: Refuse adding invalid HTTP 2.0 headers

rmaucher commented on issue #277: URL: https://github.com/apache/tomcat/pull/277#issuecomment-617239514 I will maintain my -1 For starters, any such HTTP/2 specific nonsense safety nets need to be added to StreamProcessor.prepareHeaders instead of other random locations.