HTTP/2: The Sequel is Always Worse
PortSwigger researcher James Kettle pioneers HTTP/2 request smuggling, uncovering critical implementation flaws when front-end reverse proxies downgrade to back-end HTTP/1.1.
Summary
The False Assumption of HTTP/2 Transport Transparency
Web administrators widely treat HTTP/2 as a drop-in binary transport layer, assuming protocol translation to legacy HTTP/1.1 backend servers is security-neutral.
Uncovering HTTP/2 Request Splitting and Smuggling
James Kettle reveals that binary HTTP/2 framing allows embedding forbidden HTTP/1.1 newline characters, spaces, and duplicate headers inside pseudo-headers.
Exploiting Protocol Downgrade Mismatches (H2.CL / H2.TE)
When front-end reverse proxies downgrade malformed HTTP/2 frames into plaintext HTTP/1.1 streams, backend servers desynchronize, allowing attackers to poison caches, steal credentials, and hijack web sessions.
Hardening Web Infrastructure and Gateway Protocols
Kettle provides web architects with detection tooling, testing suites, and remediation guidelines to enforce strict RFC compliance across reverse proxies.
Related talks
Main Stage·46 min
Martin Doyhenard
Martin Doyhenard introduces HTTP Response Smuggling, exploiting desynchronization in HTTP/1.1 response pipelines to poison caches and hijack user sessions.
Main Stage·40 min
Dongsung Kim
Dongsung Kim demonstrates how modern browser features and emerging Web APIs can be chained to resurrect Cross-Site Request Forgery (CSRF) despite SameSite cookies.
Main Stage·42 min
James Kettle
PortSwigger head of research James Kettle unveils browser-powered desync attacks, turning victim web browsers into desynchronization weapons against major websites.