draft-nygren-httpbis-http11-request-binding-01

I've briefly reviewed draft-nygren-httpbis-http11-request-binding-01,
and developed the following question: Is this draft intended to be
implementable by an application using an unmodified HTTP/1.1 library
through a high-level API?

If so, I believe I understand the value in this work, as it would
afford some protection to deployments that cannot replace their HTTP
library.  In that case, I would like to see the draft (1) make this
use case more explicit, (2) clearly recommend upgrading to HTTP/2
instead if possible, and (3) consider some consequences of this
arrangement, such as the possibility that the HTTP library is using an
unexpected HTTP version.

The question of negotiation is also relevant here.  An unmodified
HTTP+TLS library would presumably not negotiate this new ALPN, for
example.  So perhaps the intended use is for applications that manage
TLS and HTTP separately?

If the intended use cases require modifications to the HTTP
implementation, then I continue to doubt the net value of this
proposal.  Anyone who can modify their HTTP implementation and is
concerned about this security risk should upgrade to HTTP/2.

A demo implementation of this, sitting atop the relevant standard
library's implementation of HTTP, would be helpful for clarity.

--Ben Schwartz

Received on Wednesday, 22 July 2026 20:35:40 UTC