Skip to content

Document that pushed origins aren't checked #536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ericmj wants to merge 1 commit into from
Open

Document that pushed origins aren't checked #536

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions lib/mint/http2.ex
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,12 @@ defmodule Mint.HTTP2 do
] = responses

promised_headers
#=> [{":method", "GET"}, {":path", "/style.css"}]
#=> [
#=> {":method", "GET"},
#=> {":scheme", "https"},
#=> {":authority", "example.com"},
#=> {":path", "/style.css"}
#=> ]

As you can see in the example above, when the server sends a push promise then a
`:push_promise` response is returned as a response to a request. The `:push_promise`
Expand All @@ -100,7 +105,12 @@ defmodule Mint.HTTP2 do
`promised_headers` are headers that tell the client *what request* the promised response
will respond to. The idea is that the server tells the client a request the client will
want to make and then preemptively sends a response for that request. Promised headers
will always include `:method`, `:path`, and `:authority`.
will always include `:method`, `:scheme`, `:authority`, and `:path`.

A server may only push responses for origins it's authoritative for (RFC 9113 8.4).
Mint doesn't check this. Before using a pushed response, for example to cache it,
compare `:scheme` and `:authority` with the origin you connected to, and cancel the
promised request with `cancel_request/2` if they don't match.

next_message =
receive do
Expand Down
Loading