WebPerf Google dropping SPDY in favor of HTTP 2

eva2000 · Mar 24, 2015

More HTTP/2 info HTTP/2: big security and ethical questions still to be answered | Tibus

BamaStangGuy · Mar 24, 2015

I am frustrated at this push to secure everything by Google while at the same time advertising networks are not supporting that trend.

eva2000 · Mar 24, 2015

BamaStangGuy said: ↑

I am frustrated at this push to secure everything by Google while at the same time advertising networks are not supporting that trend.
Click to expand...

Yeah wonder what are the top factors preventing ad networks and advertisers from going https / SSL compliant. You don't need to redirect all http traffic to https - just have the ads capable of being served from both http and https.

More HTTP/2 info HTTP/2: The future of the Web demystified | InfoWorld

Just because you upgraded to HTTP/2 doesn’t mean other people have. If you’re serving a site that pulls in content from third-party providers, such as a Web traffic tracking system, there’s no guarantee those connections won’t be served over HTTP/1.1. This will, again, theoretically make your site load slower than if you had been using HTTP/1.1.

HTTP/2 won’t add encryption for you. Even if we didn’t live in a post-Snowden world, mandating encryption for HTTP connections everywhere would in theory make it far harder to get away with many common kinds of attacks carried out via HTTP. In fact, there was discussion early on in the proposal process to make HTTP/2 connection encryption mandatory, but it lost out for a variety of reasons.

That said, the browser makers -- Firefox and Chrome in particular -- have elected to support HTTP/2 only over connections where TLS is present. Thus, to get the most out of HTTP/2, you’re best off deploying it with an encrypted connection, lest the people who’ll most benefit from it end up never using it. If the cost of a certificate is a stumbling block, the EFF and Mozilla are at work on a plan to provide free encryption certificates for all sites that want it later this year -- right around the time HTTP/2 itself has become a full-blown entity.
Click to expand...

eva2000 · Mar 25, 2015

More HTTP/2 info and best practices

Preparing for HTTP2 | Blog | Web Design Essex

HTTP/2 for a Faster Web | Cascading Media

eva2000 · Mar 29, 2015

Web Performance: The Status of HTTP/2 (H2) - Ma... | Akamai

Update: The final draft (h2-17) was approved last month. Although the new RFC has not been published yet, HTTP/2 (H2) is quickly gaining adoption with more browsers providing HTTP/2 support out of the box.

As of March 23, 2015, here are the Web browsers that work with H2:

Chrome supports HTTP/2 (draft h2-14) by default (verified as of version 41)

Chrome Canary (kind of the Beta version of Chrome where new features are tested) supports HTTP/2 (final draft h2-17) by default (verified as of version 43). Adding support for the final draft allows seeing more interesting stuff using chrome://net-internals/#spdy

Chrome for iOS (mobile version) supports HTTP/2 by default (verified as of version 41).

Chrome for Android (mobile version) supports HTTP/2 by default (verified as of version 41).

Firefox supports HTTP/2 by default (verified as of version 36).

Internet Explorer supports HTTP/2 in version 11, but only for Windows 10 beta, and is enabled by default.

Opera supports HTTP/2 by default (verified as of version 28).

As of Web servers: (source: Wikipedia)

IIS supports HTTP/2 in Windows 10 beta

OpenLiteSpeed 1.3.8 and 1.4.5 support HTTP/2 draft 17

Nginx does NOT support HTTP/2 yet (it supports SPDY though), but has officially announced support by the end of 2015

Akamai Ghost (Global host) supports HTTP/2 draft h2-14 (through Akamai's Beta channel)

Are you curious to know if a different browser supports H2? It is rather easy, just open HTTP/2: the Future of the Internet | Akamai with the browser to identify whether it supports H2 or not (see screenshot below).
Click to expand...

eva2000 · Mar 29, 2015

Firefox 37 and Opportunistic Encryption = TLS over http non-encrypted connections via SPDY/3.1 or Alt-Svc: h2 headers ("alternative services") Bits Up!: Opportunistic Encryption For Firefox

Firefox 37 brings more encryption to the web through opportunistic encryption of some http:// based resources. It will be released the week of March 31st.

OE provides unauthenticated encryption over TLS for data that would otherwise be carried via clear text. This creates some confidentiality in the face of passive eavesdropping, and also provides you much better integrity protection for your data than raw TCP does when dealing with random network noise. The server setup for it is trivial.

These are indeed nice bonuses for http:// - but it still isn't as nice as https://. If you can run https you should - full stop. Don't make me repeat it Only https protects you from active man in the middle attackers.

But if you have long tail of legacy content that you cannot yet get migrated to https, commonly due to mixed-content rules and interactions with third parties, OE provides a mechanism for an encrypted transport of http:// data. That's a strict improvement over the cleartext alternative.

Two simple steps to configure a server for OE

Install a TLS based h2 or spdy server on a separate port. 443 is a good choice . You can use a self-signed certificate if you like because OE is not authenticated.

Add a response header Alt-Svc: h2=":443" or spdy/3.1 if you are using a spdy enabled server like nginx.

When the browser consumes that response header it will start to verify the fact that there is a HTTP/2 service on port 443. When a session with that port is established it will start routing the requests it would normally send in cleartext to port 80 onto port 443 with encryption instead. There will be no delay in responsiveness because the new connection is fully established in the background before being used. If the alternative service (port 443) becomes unavailable or cannot be verified Firefox will automatically return to using cleartext on port 80. Clients that don't speak the right protocols just ignore the header and continue to use port 80.

This mapping is saved and used in the future. It is important to understand that while the transaction is being routed to a different port the origin of the resource hasn't changed (i.e. if the cleartext origin was Example Domain then the origin, including the http scheme and the port 80, are unchanged even if it routed to port 443 over TLS). OE is not available with HTTP/1 servers because that protocol does not carry the scheme as part of each transaction which is a necessary ingredient for the Alt-Svc approach.

You can control some details about how long the Alt-Svc mappings last and some other details. The Internet-Draft is helpful as a reference. As the technology matures we will be tracking it; the recent HTTP working group meeting in Dallas decided this was ready to proceed to last call status in the working group.
Click to expand...

From draft-ietf-httpbis-alt-svc-04 - HTTP Alternative Services

For example:

Alt-Svc: h2=":8000"

This indicates the "h2" protocol ([HTTP2]) on the same host using the
indicated port 8000.

An example involving a change of host:

Alt-Svc: h2="new.example.org:80"

This indicates the "h2" protocol on the host "new.example.org",
running on port 80. Note that the "quoted-string" syntax needs to be
used because ":" is not an allowed character in "token".

Examples for protocol name escaping:

+--------------------+-------------+---------------------+
| ALPN protocol name | protocol-id | Note |
+--------------------+-------------+---------------------+
| h2 | h2 | No escaping needed |
+--------------------+-------------+---------------------+
| w=x:y#z | w%3Dx%3Ay#z | "=" and ":" escaped |
+--------------------+-------------+---------------------+
| x%y | x%25y | "%" needs escaping |
+--------------------+-------------+---------------------+

Alt-Svc MAY occur in any HTTP response message, regardless of the
status code.

The Alt-Svc field value can have multiple values:

Alt-Svc: h2c=":8000", h2=":443"

The value(s) advertised by Alt-Svc can be used by clients to open a
new connection to one or more alternative services immediately, or
simultaneously with subsequent requests on the same connection.

When using HTTP/2 ([HTTP2]), servers SHOULD instead send an ALTSVC
frame (Section 4). A single ALTSVC frame can be sent for a
connection; a new frame is not needed for every request.

Note that all field elements that allow "quoted-string" syntax MUST
be processed as per Section 3.2.6 of [RFC7230].
Click to expand...

eva2000 · Mar 29, 2015

Using Firefox 38 developer edition to test out Opportunistic Encryption over clear text http on Centmin Mod's Nginx server on port 82 with Alt-Svc: h2=":8081" header set to pass unauthenticated encryption over TLS via my h2o HTTP/2 server setup on port 8081. Checking Firefox 38's developer tools network headers you can clearly see http connections being passed and served via h2 protocol = HTTP/2

One thing I am not clear on in the article at Bits Up!: Opportunistic Encryption For Firefox is whether this means a total end to mixed content warnings in browsers that support Opportunistic Encryption ?? Will it be okay to have http and https mixed if http uses Opportunistic Encryption to pass the data over encrypted SPDY/3.1 or HTTP/2 server with Alt-Svc:h2 or SPDY/3.1 headers ?

Edit: Patrick McManus from Firefox himself clarified OE and mixed content warnings. OE doesn't help with mixed content warnings.

OE des not change the scheme of the transaction - it stays http:// and the rules about mixing https:// and http:// continue to apply unchanged. OE is simply a better version of plaintext, it doesn't change the web security model.
Click to expand...

But if you have long tail of legacy content that you cannot yet get migrated to https, commonly due to mixed-content rules and interactions with third parties, OE provides a mechanism for an encrypted transport of http:// data. That's a strict improvement over the cleartext alternative.
Click to expand...

over curl client the Alt-Svc:h2 header is seen but not used as curl doesn't support Opportunistic Encryption. Firefox 37+ will though. Hoping Chrome and other major browsers support it too
Code:
curl -I http://h2ohttp2.centminmod.com:82/flags.html
HTTP/1.1 200 OK
Date: Sun, 29 Mar 2015 00:52:36 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 63207
Last-Modified: Sat, 28 Mar 2015 04:51:44 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "55163360-f6e7"
Server: nginx centminmod
Expires: Sun, 29 Mar 2015 01:07:36 GMT
Cache-Control: max-age=900
Cache-Control: public, must-revalidate, proxy-revalidate
Alt-Svc: h2=":8081"
Accept-Ranges: bytes
edit: looks like mixed content warnings still exist right now with Firefox 38 developer edition and Nginx http 82 passing data to h2o HTTP/2 TLS server on port 8081 despite the single flag on port 82 show as secured over HTTP/2 = h2 protocol by Firefox

eva2000 · Apr 1, 2015

More info

The state and rate of HTTP/2 adoption

Firefox Opportunistic Encryption is now out with Firefox 37 via AltSvc H2 header Firefox 37 Coming Today With Heartbeat, HTTPS Bing - Phoronix

eva2000 · Apr 2, 2015

More on Firefox new version and Opportunistic Encryption New Firefox version says “might as well” to encrypting all Web traffic | Ars Technica

Developers of the Firefox browser have moved one step closer to an Internet that encrypts all the world's traffic with a new feature that can cryptographically protect connections even when servers don't support the HTTPS protocol.

Opportunistic encryption, as the feature is known, acts as a bridge between plaintext HTTP connections and fully compliant HTTPS connections based on transport layer security or its predecessor, protocol secure sockets layer. These traditional Web-based encryption measures require site operators to obtain a digital credential issued by a browser-recognized certificate authority and to implement TLS protection through OpenSSL or a similar code library. Even then, many sites are unable to fully encrypt their pages because they embed ads and other third-party content that's still transmitted in plaintext. As a result, large numbers of sites (including this one) continue to publish some or all of their content in HTTP, which can be readily manipulated by people with the ability to monitor the connection.
OE, as opportunistic encryption is often abbreviated, was turned on by default in Firefox 37, which was released this week. The move comes 17 months after an Internet Engineering Task Force working group proposed OE become an official part of the HTTP 2.0 specification. The move garnered critics and supporters alike, with the former arguing it may delay some sites from using the more secure HTTPS protections and the latter saying, in effect, some protection is better than none. The chief shortcoming of OE is its lack of authentication for cryptographically validating that a connected server is operated by the organization claiming ownership.
Click to expand...

eva2000 · Apr 6, 2015

Looks like Firefox disabled Opportunistic Encryption in 37.01 Mozilla Firefox 37.0.1 Out Now, Disables HTTP/2 AltSvc and Fixes Bugs - Softpedia

While Mozilla Firefox 37.0 has been released on March 31, we can report today that Mozilla Firefox 37.01 is a small update that disables HTTP/2 AltSvc (Alternative Services), and fixes a start-up crash that occurred because of some graphics hardware and third-party software.

Several security fixes have also been implemented in the first maintenance release of Mozilla Firefox 37.0, such as an issue with certificate verification that could bypass through the HTTP/2 Alt-Svc header, and loading of privileged content through the Reader mode.

As usual, we strongly recommend that you immediately update your Mozilla Firefox web browser to the latest stable version available. Do so, simply access the “About Firefox” dialog and wait for the update to be downloaded and applied. Restart Firefox to finish the update process.
Click to expand...

flaw Certificate verification bypass through the HTTP/2 Alt-Svc header — Mozilla

Security researcher Muneaki Nishimura discovered a flaw in the Mozilla's HTTP Alternative Services implementation. If an Alt-Svc header is specified in the HTTP/2 response, SSL certificate verification can be bypassed for the specified alternate server. As a result of this, warnings of invalid SSL certificates will not be displayed and an attacker could potentially impersonate another site through a man-in-the-middle (MTIM), replacing the original certificate with their own.
Click to expand...

eva2000 · Apr 6, 2015

hmm Nginx's own road map has HTTP/2 due in 13 months in 1.9 mainline Roadmap – nginx ? with Nginx 1.8.x due in 2 weeks time.

Milestone: 1.9

Due in 13 months (Apr 19, 2016 6:00:00 PM)
Status: on-going development
Trunk: mainline

1.9 planned features and improvements

Dynamic modules support

HTTP/2

TBD

Click to expand...

eva2000 · Jun 1, 2015

Ilya Grigorik's slide presentation on HTTP/2 at VelocityConf HTTP/2 is here, let's optimize! - Velocity SC 2015 - Google Slides

rdan · Jun 11, 2015

Sadly not with 1.9.2 Roadmap – nginx

Milestone: 1.9.2
Due in 6 days (Jun 16, 2015 6:00:00 PM)
Status: scheduled

Trunk: mainline
stream modules addons
OSCP stapling fix
config dump

eva2000 · Jun 11, 2015

guess they're thoroughly testing HTTP/2 for nginx first

rdan · Jun 11, 2015

eva2000 said: ↑

guess they're thoroughly testing HTTP/2 for nginx first
Click to expand...

Haha not trying to be like OLS

eva2000 · Jun 21, 2015

First screenshot of Nginx with HTTP/2 posted on twitter https://twitter.com/nginxorg/status/611571433353777152

eva2000 · Aug 12, 2015

First Nginx HTTP/2 Alpha patches out Nginx - First Alpha Patch for Nginx HTTP/2 support | Centmin Mod Community

eva2000 · Sep 2, 2015

Another nice HTTP/2 benchmark test Revisiting webapp performance on HTTP/2 - Advanced Web Machinery

rdan · Sep 2, 2015

With SPDY well supported still: Can I use... Support tables for HTML5, CSS3, etc
I'd stick with it for now.
Instead of enabling HTTP/2 when only modern browser support it.

eva2000 · Sep 2, 2015

Ah indeed if browser compatibility is an issue

Log in / Register

Forums

Want to subscribe to topics you're interested in?

WebPerf Google dropping SPDY in favor of HTTP 2

eva2000 Administrator Staff Member

BamaStangGuy Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

WebPerf Google dropping SPDY in favor of HTTP 2

eva2000 Administrator Staff Member

BamaStangGuy Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

.