Skip to content

TLS does not enforce ALPN protocol  #434

@carl-mastrangelo

Description

@carl-mastrangelo

According to https://tools.ietf.org/html/rfc7540#section-3.3 connections over TLS use the "h2" application protocol identifier. Attempting to use another protocol identifier, such as "h2c", should fail the connection. Currently, the Grpc go server accepts using this invalid identifier when establishing a TLS connection.

Here is the test that fails:

https://github.com/grpc/grpc/blob/master/tools/http2_interop/http2interop.go#L235

Metadata

Metadata

Assignees

No one assigned

    Labels

    Area: TransportIncludes HTTP/2 client/server and HTTP server handler transports and advanced transport features.P2Status: BlockedType: Bug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions