Hacker News Reader

More than that, they relate to proxies. This sentence seems the crux to me:

> If you're coding an HTTP/2 server, especially one that supports downgrading, enforce the charset limitations present in HTTP/1 - reject requests that contain newlines in headers, colons in header names, spaces in the request method, etc.

View on HN

I imagine it also relates to things that really "proxies", but not normally thought of as such. Like PHP-FPM, wsgi, etc. Those are also doing protocol and header translation, and are very ubiquitous.

What's wrong with it? It seems reasonable to protect yourself from header-injections allowed by a downgrade?

Am I misunderstanding?

I don't think there's anything wrong with it, it's great advice!

Reply on news.ycombinator.com